Methods for Avoiding the 'Small-Subgroup' Attacks on the Diffie-Hellman Key Agreement Method for S/MIME

摘要

In some circumstances the use of the Diffie-Hellman key agreementscheme in a prime order subgroup of a large prime p is vulnerable tocertain attacks known as 'small-subgroup' attacks. Methods exist,however, to prevent these attacks. This document will describe thesituations relevant to implementations of S/MIME version 3 in whichprotection is necessary and the methods that can be used to preventthese attacks.