-1

This question is specific and only concerns Google Cloud VPN.

Google Reference https://cloud.google.com/vpn/docs/concepts/supported-ike-ciphers

Cisco Definition (group 24) https://supportforums.cisco.com/t5/security-documents/diffie-hellman-groups/ta-p/3147010

wibobm
  • 696
  • 7
  • 13

2 Answers2

1

Yes, they are the same. The DH group numbers can be found in the IKEv2 registry at IANA and the modp_1024s160, modp_2048s224, modp_2048s256 represent groups 22, 23 and 24, respectively.

Please note that the use of these groups has been discouraged by RFC 8247:

Groups 22, 23, and 24 are MODP groups with Prime Order Subgroups that are not safe primes. The seeds for these groups have not been publicly released, resulting in reduced trust in these groups. These groups were proposed as alternatives for groups 2 and 14 but never saw wide deployment. It has been shown that group 22 with 1024-bit MODP is too weak and academia have the resources to generate malicious values at this size. This has resulted in group 22 to be demoted to MUST NOT. Groups 23 and 24 have been demoted to SHOULD NOT and are expected to be further downgraded in the near future to MUST NOT.

Community
  • 1
  • 1
ecdsa
  • 542
  • 3
  • 12
1

It would be helpful if their documentation provided the group number like this:

  • 1024-bit w/ 160-bit prime order subgroup = Group 22
  • 2048-bit w/ 224-bit prime order subgroup = Group 23
  • 2048-bit w/ 256-bit prime order subgroup = Group 24

It's easy to confuse Group 24 with Group 19, which is in the more widely supported ECP family:

  • 256-bit Elliptic Curve = Group 19
  • 384-bit Elliptic Curve = Group 20
  • 521-bit Elliptic Curve = Group 21
John Heyer
  • 711
  • 1
  • 6
  • 18