Re: [Cfrg] Security proofs v DH backdoors

[Ilari Liusvaara <[e-mail]>]

On Sun, Oct 30, 2016 at 10:56:48AM +0000, Peter Gutmann wrote:
> Michael Scott <[e-mail]> writes:
> 
> >As an influential opinion leader I think you really need to expand on that
> >last paragraph. In the first sentence you need to define "harsh environment".
> >The second sentence ("any fault of any kind") is manifestly untrue. And in
> >the third sentence what industries exactly?
> 
> So I've been sitting here trying to figure out how to respond to this (and one
> or two other messages).  I think there must be some sort of miscommunication
> happening because I can't otherwise explain why you're asking what you are.
> The options seem to be:
> 
> 1. You're unaware of how vulnerable to faults ECC is.
> 2. You're unaware that computers experience faults.
> 3. We're talking at cross purposes/miscommunicating in some way.
> 
> Before I type up a long essay on #1 or #2 (which I'm not terribly keen on
> doing) I want to make sure that you're really asking what you appear to be
> asking, and one or both of us hasn't misinterpreted the others' position.

Is ECC even more vulernable to faults than e.g. RSA-CRT? AFAIK, release
even _one_ any way faulty signature computed using RSA-CRT and your
private key walks.

It is so bad that most implementations using RSA-CRT internally
verify the generated signature first. Even if not operating in any sort
of "harsh" environment.

I certainly haven't heard anything similar for ECC. Fault key recovery
attacks yes, but those at least required some degree of control over
the faults, not "one random fault and key walks" RSA-CRT has.

For determininistic ECC signatures, computing the signature twice and
comparing is cheaper than verifying it.


-Ilari