Verification of primes in /etc/ssh/moduli file

[Damien Miller]

On Thu, 26 Aug 2021, Demi Marie Obenour wrote:

> One can prove primality using the Miller-Ramin test, which will
> detect composites with probability at least 3/4 per round.  After 64
> rounds the likelihood of a composite not being detected is not more
> than 2⁻¹²⁸, even for adversarial choices of moduli.  Note that
> the primality testing APIs in cryptographic libraries are often not
> designed for this, as they perform optimizations that are not valid for
> adversarially chosen numbers.

I assumed the safety of most libraries in the adversarial model was
fixed a while ago, after https://eprint.iacr.org/2018/749.pdf pointed
out a bunch of flaws. Shame on me for not checking thoroughly...

-d