Re: [Cfrg] Switching the zero-check from MUST to MAY in the curves draft.

What is the probability that all zeros occurs at random?

Is there a mechanism that would allow an attacker to force use of all zeros?

On Mon, Nov 16, 2015 at 6:03 PM, Adam Langley <agl@imperialviolet.org> wrote:
> At the moment, the curves draft says that implementations MUST check
> for the all-zero output and abort if it's found, at least in
> Diffie-Hellman. The all-zero output results when the input point has
> small order and this sort of thing has, in the past, broken at least
> Tor and TLS channel bindings.
>
> While reactions on the list were ambivalent to the suggestion, I had
> hoped that implementations would take this requirement as a simple
> defence-in-depth measure in keeping with the general robustness theme
> of this work.
>
> I was mistaken. It's since become clear that some disagree
> sufficiently strongly about this that we aren't going to see a
> realignment of implementations around this behaviour. While I still
> think that it's a sensible requirement, RFCs that are prescriptive
> rather than descriptive are terrible and so I currently hope to switch
> from MUST to MAY once the draft has completed the editor's queue.
> Instead, some wording would be added to the Security Considerations
> section.
>
> This change contains the accumulation of tweaks that I currently have
> saved up, including this one:
> https://github.com/agl/cfrgcurve/commit/c7749d4bb5ceabdb30f211d4aaa6df2b68d7c5e1
>
> This email is notice that I currently plan on making this change. Note
> that the question here isn't whether the zero check is a good idea or
> not. Rather it's that, given that a non-trivial number of
> implementations aren't going to implement it, what's the best thing to
> write?
>
>
> Cheers
>
> AGL
>
> --
> Adam Langley agl@imperialviolet.org https://www.imperialviolet.org
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg