Verification of primes in /etc/ssh/moduli file

Damien Miller djm at
Mon Aug 30 14:42:52 AEST 2021

On Thu, 26 Aug 2021, Demi Marie Obenour wrote:

> One can prove primality using the Miller-Ramin test, which will
> detect composites with probability at least 3/4 per round.  After 64
> rounds the likelihood of a composite not being detected is not more
> than 2⁻¹²⁸, even for adversarial choices of moduli.  Note that
> the primality testing APIs in cryptographic libraries are often not
> designed for this, as they perform optimizations that are not valid for
> adversarially chosen numbers.

I assumed the safety of most libraries in the adversarial model was
fixed a while ago, after pointed
out a bunch of flaws. Shame on me for not checking thoroughly...


More information about the openssh-unix-dev mailing list