Re: [Cfrg] Handling invalid points

[Ilari Liusvaara <[e-mail]>]

On Fri, Nov 21, 2014 at 11:12:33PM -0000, D. J. Bernstein wrote:
> 
> Why would anyone talk about small-subgroup attacks as being stopped by a
> "check" that might be "forgotten", the same way that a curve-equation
> check can stop invalid-curve attacks but might be forgotten? Answer:
> What I've described so far is
> 
>    * a computational (robust) defense against small-subgroup attacks,
>    * a verifying (not robust) defense against invalid-curve attacks, and
>    * a computational (robust) defense against invalid-curve attacks,
> 
> but there's also
> 
>    * a verifying (not robust) defense against small-subgroup attacks.
> 
> Specifically, instead of multiplying the incoming point Q by h, one can
> check whether hQ = 0. This check runs a serious risk of being omitted,
> the same way that a curve-equation check runs a serious risk of being
> omitted, although the resulting damage is much less severe.

Also keep in mind for what CFRG is giving recommendations.

Small subgroup attacks: TLS can easily deal with small-subgroup attacks
without extra checks.

Invalid-curve attacks: The only realistic way of avoiding checks there
is to pick complete twist-secure Montgomery curve.

Implementation environment: Software-only uses of ECC in TLS utterly
dwarf any hardware implementations (embedded does not mean hardware).

And number of software implementations that need serious timing attack
protections dwards hardware implementations that need advanced side
channel protections (and those software protections are very nasty to
implement unless curve is complete).


-Ilari