Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Andy Lutomirski <[e-mail]>]

On Mon, Sep 8, 2014 at 11:51 AM, Nico Williams <[e-mail]> wrote:
> On Wed, Sep 3, 2014 at 12:27 AM, Tanja Lange <[e-mail]> wrote:
>> What exactly do you think the security implications of key reuse are?
>>
>> Defining ephemeral in a time-based manner ist quite normal; the important
>> thing to guarantee PFS is to delete the key afterwards, not whether it is
>> used for 1 connection or 10 seconds (with potentially 0 connections).
>
> +1.
>
> What matters is that the private key be destroyed some time after it's
> been used.  That amount of time cannot be zero (it could, with the
> right hardware, but that's another story).  It has to be some small
> amount of time.  .01 seconds or 10 seconds doesn't make much
> difference -- it doesn't make _any_ substantial difference.
>
> As for key reuse (as opposed to how long after use the key is
> destroyed), obviously it cannot be bad, otherwise we'd only have
> ephemeral-ephemeral DH.  But we've been using DH with static keys
> since DH was invented.
>
> No plausible case has yet been made against ephemeral DH key reuse.  I
> can't think of a plausible case against it.  I'm inclined to believe
> there is no plausible case to be made against it within the current
> published literature.

OK, I'll bite.

If the various standards are to be interpreted as permitting parties
to reuse their ephemeral DH keys for a short time, *which party* is
allowed to do so?  I bet that, if both parties in a DH exchange reuse
their ephemeral keys in multiple DH exchanges with each other, the
security properties of various protocols degrade in varying amounts
from "anything resembling a security proof is invalidated" to
"completely insecure".

Certainly the any exchange of the form K = H(g^(a+b)) followed by use
of most AEADs (e.g. GCM, most things using Poly1305, etc) starting
with IV 0 and key K (or a hash of K) will fail catastrophically.

In summary, I think that a protocol intended to allow ephemeral key
reuse needs to specify that reuse is allowed (so the proofs can be
designed correctly) and to specify *how* the keys may be reused (to
avoid catastrophic failure).

>
> PFS depends on timely destruction of private keys, not non-reuse.

And integrity, and possibly even confidentiality, depends on non-reuse
of derived keys... :)

I hope that OpenSSL doesn't already reuse ECDH keys on the client.
The code is entirely incomprehensible, so my five minutes of trying to
understand it went nowhere at all.

--Andy