Re: [Cfrg] Switching the zero-check from MUST to MAY in the curves draft.

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Nov 17, 2015 at 9:31 AM, Watson Ladd <[e-mail]> wrote:
> On Tue, Nov 17, 2015 at 9:16 AM, Taylor R Campbell
> <[e-mail]> wrote:
>>    Date: Mon, 16 Nov 2015 18:29:42 -0800
>>    From: Mike Hamburg <[e-mail]>
>>
>>    > On Nov 16, 2015, at 18:01, Phillip Hallam-Baker <[e-mail]> wrote:
>>    >
>>    > Is there a mechanism that would allow an attacker to force use of
>>    > all zeros?
>>
>>    Yes, an attacker can easily force it by sending specific values of
>>    g^x, most of which cannot be produced by a legitimate
>>    implementation.  There are something like 5 such values for
>>    curve448 and 14 such values for curve25519.
>>
>> A malicious peer can do that, but so what?  A malicious peer can also
>> use a secret key k known to an eavesdropper, and send k*B where B is
>> the standard base point.  Then the eavesdropper seeing the good guy's
>> public key h*B over the wire can readily predict k*h*B and find the
>> session key.  A malicious peer could also email the session transcript
>> to the eavesdropper.
>>
>> What is the serious attack that is prevented by a zero check?  It
>> seems to me an answer to that question is more important than the
>> choice of verb.
>
> Some protocols require contributory behavior from DH exchanges.
> Examples include TLS. Most protocol designers understood how to avoid
> this, but TLS was not designed by a cryptographer. This went unnoticed
> until very recently, when it was exploited in the Triple-Handshake
> attack.

SSL 1.0 and SSL 2.0 were not. But SSL 3.0 was designed by Paul Kocher
working for Taher El-Gamal.

The problem was that he only had two weeks to do the work and Netscape
did not put the proposal out for public review. You might think that
you would want to do that after your first attempt was broken fifteen
minutes into the first (and only) presentation outside the company.
Thats not the way Netscape went about things.