joyent/node — Issue #2338: crypto - can't use Second Oakley Group from RFC 2412 for DH Exchange
Author: thinred
Created: 2011-12-15 10:37:14+00:00
State: open

Hi,
I am trying to use the group described in http://tools.ietf.org/html/rfc2412 to perform Diffie-Hellman Key Exchange. Unfortunately I get this:

crypto = require('crypto');
p = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'
dh = crypto.createDiffieHellman(p, 'hex')
dh.generateKeys();
Error: Not initialized
at repl:1:4
at REPLServer.eval (repl.js:80:21)
at repl.js:190:20
at REPLServer.eval (repl.js:87:5)
at Interface. (repl.js:182:12)
at Interface.emit (events.js:67:17)
at Interface._onLine (readline.js:162:10)
at Interface._line (readline.js:426:8)
at Interface._ttyWrite (readline.js:603:14)
at ReadStream. (readline.js:82:12)

I've traced the problem to DiffieHellman::VerifyContext where DH_check is used. It returns DH_NOT_SUITABLE_GENERATOR from OpenSSL and NodeJS object is not initialized. If you take a look at the OpenSSL library, you will notice that if generator is 2 (and this is the case here) the prime is checked to be congruent to 11 modulo 24. The prime above is in fact congruent to 23 and there is the problem.
In fact, the RFC mentions that: [...] *Note that 2 is technically not a generator in the number theory sense, because it omits half of the possible residues mod P. From a cryptographic viewpoint, this is a virtue.* [...]. This is true but NodeJS will complain. I've also found this discussion from 2002 which is about the same problem: http://www.mail-archive.com/openssl-dev@openssl.org/msg11453.html .

An easy fix would be to add flag (defaults to false) to ignore DH_check result (or at least DH_NOT_SUITABLE_GENERATOR flag). I would be happy to prepare the patch, but I would like to know what you guys think.

Cheers!
Tomek