More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
Extracted elements (13)
Groups larger than 8192 bits are not specified because with current hardware they are too slow for practical use, even though 192 and 256-bit AES keys might theoretically require groups of 8000-15400 bits.
The document does not specify which group to use with 128, 192, or 256-bit AES because there is significant disagreement among cryptographers about required DH group sizes: one source estimates a 3200-bit group for 128-bit AES while another estimates 2500 bits for 192-bit AES. Rather than mandate a pairing, the document simply provides multiple group options.
The primes for all defined groups were selected following criteria established by Richard Schroeppel, ensuring the primes have specific cryptographic properties suitable for Diffie-Hellman key exchange.
Group 5 (1536-bit) was already in widespread implementation use before this document, designated by implementations as group 5, but was not defined in RFC 2409. This document standardizes that existing practice.
The exponent size used in Diffie-Hellman must be selected so that it is not the weakest link in the security system, and should have double the entropy of the strength of the entire system.
The 1536-bit MODP Group (Group 5) uses a prime of the form 2^1536 - 2^1472 - 1 + 2^64 * { [2^1406 pi] + 741804 } with generator 2. This group had been used in implementations prior to standardization and is now formally assigned id 5.
The 2048-bit MODP Group is assigned id 14. Its prime is 2^2048 - 2^1984 - 1 + 2^64 * { [2^1918 pi] + 124476 } with generator 2.
The 3072-bit MODP Group is assigned id 15. Its prime is 2^3072 - 2^3008 - 1 + 2^64 * { [2^2942 pi] + 1690314 } with generator 2.
The 4096-bit MODP Group is assigned id 16. Its prime is 2^4096 - 2^4032 - 1 + 2^64 * { [2^3966 pi] + 240904 } with generator 2.
The 6144-bit MODP Group is assigned id 17. Its prime is 2^6144 - 2^6080 - 1 + 2^64 * { [2^6014 pi] + 929484 } with generator 2.
The 8192-bit MODP Group is assigned id 18. Its prime is 2^8192 - 2^8128 - 1 + 2^64 * { [2^8062 pi] + 4743158 } with generator 2.
This document extends the IKE Diffie-Hellman Group registry. IKE (RFC 2409) originally defined groups 1-4; this document adds group 5 and groups 14-18. New group assignments require IETF Consensus and must be documented in a Standards Track RFC.
Strength estimates for the defined groups range from approximately 90-120 bits for the 1536-bit group (id 5) up to 190-310 bits for the 8192-bit group (id 18). The exponent used in Diffie-Hellman must have double the entropy of the desired security strength (e.g., a 128-bit-strength group requires more than 256 bits of randomness in the exponent).