Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Nico Williams <[e-mail]>]

On Wed, Sep 3, 2014 at 12:27 AM, Tanja Lange <[e-mail]> wrote:
> What exactly do you think the security implications of key reuse are?
>
> Defining ephemeral in a time-based manner ist quite normal; the important
> thing to guarantee PFS is to delete the key afterwards, not whether it is
> used for 1 connection or 10 seconds (with potentially 0 connections).

+1.

What matters is that the private key be destroyed some time after it's
been used.  That amount of time cannot be zero (it could, with the
right hardware, but that's another story).  It has to be some small
amount of time.  .01 seconds or 10 seconds doesn't make much
difference -- it doesn't make _any_ substantial difference.

As for key reuse (as opposed to how long after use the key is
destroyed), obviously it cannot be bad, otherwise we'd only have
ephemeral-ephemeral DH.  But we've been using DH with static keys
since DH was invented.

No plausible case has yet been made against ephemeral DH key reuse.  I
can't think of a plausible case against it.  I'm inclined to believe
there is no plausible case to be made against it within the current
published literature.

PFS depends on timely destruction of private keys, not non-reuse.

Nico
--