Re: [Cfrg] Criteria for the selection of new ECC mechanisms

[Johannes Merkle <[e-mail]>]

Rene Struik wrote on 29.04.2014 20:43:
> On 4/29/2014 2:21 PM, David McGrew wrote:
>>
>> Just for clarity: you are not disagreeing with R8, just saying that it doesn't go far enough in expressing the
>> requirements of avoiding side channels, right?
> RS>>
> In theory, I can imagine that one could have non-constant time implementations that nevertheless do not leak any
> meaningful info, although, admittedly, I do not recall having seen public papers in that direction. Stipulating point
> solution requirements re implementation security (constant-time, avoids twisted curve attacks, invalid points, etc.)
> does not capture the real requirement that we simply want good real-world implementation security. (This is a huge area
> with many pitfalls and something most CFRG people probably do not closely follow that much (CHES, FDTC, COSADE, CARDES,
> etc.), but nevertheless, in my mind, present a much higher threat than any algorithmic consideration (besides the
> obvious), esp. with highly constrained devices deployed in critical infrastructure (internet of things type, sensors,
> etc.).)
> <<RS
>>>>
>>>>    R9.  Required: resist twist attacks [2]
>>> RS>>
>>> This is just and example of a particular implementation attack in a very wide spectrum. It would be a shame if this
>>> were supposed to rule out any non "twist-secure" curves, just because of this stipulation. There are many ways to
>>> skin a cat or here and providing secure implementations.
>>> <<RS
>>
>> So, would you be comfortable moving R9 to "desired"?   Are there other attacks that we should enumerate?
> RS>>
> This is still an area in lots of flux. Well, a good read would be
> Side Channel Resistance - State-of-Art of Secure ECC Implementations, Attacks and Countermeasures (Junfeng Fan, Guo, De
> Mulder, Schaumont, Preneel, Verbauwhede, HOST 2010)
> <<RS

Another good starting point could be the following recommendations (targeted at CC certifications but applicable to
other implementations as well), which have been co-authored by Tanja Lange
https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Zertifizierung/Interpretationen/AIS_46_ECCGuide_e_pdf.pdf

Johannes