That would work, but there&#x27;s still a problem when the client can&#x27;t verify that the parameters are safe, at least when using client certificates. See the references in section 9.7 of<p><a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;draft-ietf-tls-negotiated-ff-dhe&#x2F;" rel="nofollow">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;draft-ietf-tls-negotiated-f...</a><p>As a result, that draft proposes using specific much larger parameters, on the basis of scaling considerations for the attacker. I think the authors of this paper endorse this solution.<p>(It&#x27;s OK in general if you share parameters with someone else, it just means that an attacker who can do this precomputation for those parameters gets to attack both of your DH sessions as a result.)