Re: Forward secrecy in spiped

[Colin Percival <cperciva@tarsnap.com>]

On 04/24/14 17:08, Frederick Akalin wrote:
> On Thu, Apr 24, 2014 at 4:04 PM, Colin Percival <cperciva@tarsnap.com> wrote:
>> If you receive y=1 from a protocol-compliant endpoint, it is running with
>> FPS turned off.
> 
> You're right. I had to think for a bit to come up with a proof -- for
> anyone else who is wondering, it follows from there being no
> non-trivial square roots of unity mod p for prime p, and from the fact
> that we're working in the group of quadratic residues mod p.

Much simpler proof: The standard MODP groups, including group #14 which we use,
are selected such that q = (p - 1) / 2 is prime.  Consequently the group of
quadratic residues is cyclic and 2^x = 1 mod p means that x = 0 mod q. :-)

-- 
Colin Percival
Security Officer Emeritus, FreeBSD | The power to serve
Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid