Re: [Cfrg] Security proofs v DH backdoors

[Ilari Liusvaara <[e-mail]>]

On Tue, Oct 25, 2016 at 01:10:16PM +0000, Dan Brown wrote:
> How do the 3 recent IACR eprints on FFDH backdoors‎ reconcile with
> past security proofs for TLS, SSH, etc?
> 
> Some guesses: (1) the attacks are outside the security definitions
> (=> attacks not so important?), (2) the proofs assume strong FFDH
> groups plus validation, etc.

I guess the proofs assume strong FFDH groups, such that dlog and
dh attacks are infeasible.

I think there was one TLS implementation that tries to verify the
groups sent (of course, not all can be verified, even if those
aren't maliscously constructed).

And the backdoors in one of the papers was about constructing
prime such that one can use faster special case for dlogs. That
can't be easily discovered, even if one somehow can obtain the
group order. So one can't validate against it.


-Ilari