Re: [Cfrg] ECDH subgroup attack question

RFC 2785 sec 3.1 should be read as consisting of two steps that you noted.
When Y = p-1, Y^q = p-1, where q is a large (odd) prime, and thus this
highest allowed value of Y in step 1 will be rejected in step 2.

Therefore, the range check portion is equivalent to TLS 1.3 range check. We
want to reject values Y= {1, -1 = p-1} as invalid public keys. These values
are elements of the small subgroup.

On Tue, Jan 28, 2020 at 1:46 PM Robert Moskowitz <rgm-sec@htt-consult.com>
wrote:

> In TLS 1.3, RFC 8446 sec 4.2.8.1 the testing range for Y is:
>
> 1 < Y < p-1
>
> In RFC 2785 sec 3.1, that references 2631, the range for Y is:
>
> "within the interval [2, p-1]"
>
> TLS 1.3 is more liberal, it seems to me, than 2785.
>
> What is 'right' / 'safe'.
>
> Further 2785 has a second check:
>
> Compute y^q mod p. If the result == 1, the key is valid.
>
> Is this test still advised?
>
> thank you
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>