Diffie-Hellman Group Exchange

Diffie-Hellman鍵交換をより安全にするためのプロトコル。

RFC4419で規定されている

https://datatracker.ietf.org/doc/html/rfc4419 の序文がわかりやすいので引用する

SSHを将来にわたってより安全に利用できる

Groupはおそらく群論の群のことで、固定せず、鍵交換ごとにサーバー側から指定できるようにすることで離散対数問題を事前計算などで突破するインセンティブを減らそうとしている

Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol

Abstract

This memo describes a new key exchange method for the Secure Shell

(SSH) protocol. It allows the SSH server to propose new groups on

which to perform the Diffie-Hellman key exchange to the client. The

proposed groups need not be fixed and can change with time.

1. Overview and Rationale

SSH RFC4251 is a very common protocol for secure remote login on

the Internet. Currently, SSH performs the initial key exchange using

the "diffie-hellman-group1-sha1" method RFC4253. This method

prescribes a fixed group on which all operations are performed.

The Diffie-Hellman key exchange provides a shared secret that cannot

be determined by either party alone. Furthermore, the shared secret

is known only to the participant parties. In SSH, the key exchange

is signed with the host key to provide host authentication.

The security of the Diffie-Hellman key exchange is based on the

difficulty of solving the Discrete Logarithm Problem (DLP). Since we

expect that the SSH protocol will be in use for many years in the

future, we fear that extensive precomputation and more efficient

algorithms to compute the discrete logarithm over a fixed group might

pose a security threat to the SSH protocol.

The ability to propose new groups will reduce the incentive to use

precomputation for more efficient calculation of the discrete

logarithm. The server can constantly compute new groups in the

background.