Re: [Cfrg] malicious DH base points [was Re: should the CFRG really strive for consensus?]

["Paterson, Kenny" <[e-mail]>]

Folks,

Please, let's desist from these kinds of side-track discussions. They clog
up peoples' inboxes and make it hard to see the wood from the trees in
what is already a heavily-wooded discussion.

Thanks

Kenny

On 31/12/2014 15:44, "Dan Brown" <[e-mail]> wrote:

>
>Right, I should have said hypothetical rather possible (which can also be
>read as able).
>
>
>So, under the paper's unlikely MDH hypothesis, a fast generator could be
>weak, or worse, an unexplained random-looking generator could be weak. To
>me, the best countermeasure to this hypothetical attack would be an
>explainable randomish base point. Or, one
> can just use the fastest base point, and argue this hypothesis is too
>unlikely to fret over.
>
>
>Aside: I think X9.62-2005 added an option to have pseudorandom base
>points...
>
>
>Best regards, 
>
>-- Dan
>From: Scott Fluhrer (sfluhrer)
>Sent: Wednesday, December 31, 2014 10:30 AM
>To: Dan Brown; Adam Langley; Christoph Anton Mitterer
>Cc: [e-mail]
>Subject: RE: [Cfrg] malicious DH base points [was Re: should the CFRG
>really strive for consensus?]
>
>
>
>Actually, that paper doesn¹t actually say ³it¹s possible to pick a
>malicious generator from a prime-sized group².  Instead, it (actually,
>claim 9) says ³if
> we knew of a generator/KDF pair which made deriving the shared secret
>easy, someone setting up the group could use that to select a
>random-looking generator that, with that KDF, contains a trap door that
>he could exploit².
> 
>If anything, that paper can be construed to be an argument for a
>nonrandom-looking generator (because that doesn¹t give anyone a chance to
>build in the above
> trap door).
> 
>
> 
>From: Cfrg [mailto:[e-mail]]
>On Behalf Of Dan Brown
>Sent: Wednesday, December 31, 2014 10:07 AM
>To: Adam Langley; Christoph Anton Mitterer
>Cc: [e-mail]
>Subject: [Cfrg] malicious DH base points [was Re: should the CFRG really
>strive for consensus?]
>
>
> 
>The paper talks about the possibility of malicious base points for DH:
>
>
>
>
>
>Boaz Tsaban: Fast generators for the Diffie-Hellman
> key agreement protocol and malicious standards. IACR
> Cryptology ePrint Archive 2005
><http://www.informatik.uni-trier.de/~ley/db/journals/iacr/iacr2005.html#Ts
>aban05>: 231 (2005)
>
> 
>
>It may be far-fetched, but the paper seems to show that the independence
>of DH from the base point is not quite a mathematical certainty, unless
>the
> paper has been refuted in further research.
>
> 
>
>Best regards,
>
>
>-- Dan
>
>From:
>Adam Langley
>
>Sent:
>Wednesday, December 31, 2014 9:45 AM
>
>To:
>Christoph Anton Mitterer
>
>Cc:
>[e-mail]
>
>Subject:
>Re: [Cfrg] should the CFRG really strive for consensus?
>
>
> 
>On Dec 31, 2014 1:50 PM, "Christoph Anton Mitterer"
><[e-mail]> wrote:
>> I think it's really a bad idea for the CFRG to strive so much for
>> consensus.
>If you believe in the security of curve25519 then you also believe in the
>security of Microsoft's current position at ~128 bits. They have the same
>structure and thus strictly the same strength.
>There's /no/ possibility of weakening anything, mathematically, with a
>different base point (in the correct subgroup) or by using an isogeny.
>IRTF groups do not, technically, have to reach consensus. However,
>everyone does have to function on the same Internet at the end of the day.
>Cheers
>AGL
>
>
>
>
>
>
>