[CFRG] Re: I-D Action: draft-irtf-cfrg-rsa-guidance-01.txt

[Alicja Kario <[e-mail]>]

On Friday, 6 September 2024 07:31:50 CEST, Riad S. Wahby wrote:
> Hello,
>
> With apologies for wading in while short on both context and sleep:
>
> Alicja Kario <[e-mail]> wrote:
>> RSA key generation is a very rare occurance, so it's easier to just
>> do it offline, on a trusted system, than to work to make it side
>> channel safe. So, no, I consider it out of scope.
>
> This strikes me as an assumption that makes things clean on paper but
> messy in the real world. I can imagine lots of users taking one look
> at the operational hassle of offline generation and saying "not worth it."
>
> An alternative take: RSA key generation is a very rare 
> occurrence, so it does
> not have to be particularly fast. Thus, we can afford to spend significant
> computational resources on attenuating the side channels.
>
> (Well, and implementation time, etc.)
>
> I'll stress again that I could be entirely mistaken about the context. But
> my experience has been that users of all stripes are pesky and tend to do
> what is easiest for them. And a subset of those users will not correctly
> decide which system should be trusted for offline generation.
>
> Take this drive-by opinion for what (very) little it is worth :)

The protections I talk in the Draft are for remote timing attacks, 
potentially
conducted even over the Internet.

How do you perform a remote network based attack against RSA key 
generation?

Also, RFC 8017 says nothing about how to generate the RSA parameters.

So, I consider key generation out of scope.
See https://github.com/tomato42/marvin-ietf/pull/new/outside-scope
for the proposed text.
-- 
Regards,
Alicja (nee Hubert) Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00, Brno, Czech Republic