Why does PGP use precomputed primes for DSS/DH?!?
One worry when PGP v5 was first released was the use of precomputed or “canned” values of the finite field and the generator of this field (p & g respectively) in DH, and p & q for DSS. It is quite acceptable to use public, precomputed values for these values [Sch96a], [FIPS186-1], [MOV96], [Kob94], [Sti95]. I would also recommend that the concerned user reads [Sch97a]. The concerned user can choose to switch off the “Faster key generation” if desired (and be prepared to wait far longer for the production of keys). The problem with using canned primes is that a table of p values needs only to be computed once for the field. Breaking individual keys in this field is then a relatively fast operation. Of course, computing a database of factor base logarithms for reasonable parameters is still impossible, but it would seem prudent from a security perspective to not use canned primes for long term keys [MOV96]. Or in plain English (from [BB99]): “With ElGamal, for example, the expensive key
