Re: [Cfrg] ECDH subgroup attack question

Richard Barnes <rlb@ipv.sx> Tue, 28 January 2020 22:20 UTC

MIME-Version: 1.0
References: <93a5af6f-e40b-a3aa-ef1e-17ac1feb9ace@htt-consult.com>
In-Reply-To: <93a5af6f-e40b-a3aa-ef1e-17ac1feb9ace@htt-consult.com>
From: Richard Barnes <rlb@ipv.sx>
Date: Tue, 28 Jan 2020 17:20:12 -0500
Message-ID: <CAL02cgRkbcrcgvNzueqQeGEFxMX_pO=JuEuys5txZYqcff3kxw@mail.gmail.com>
To: Robert Moskowitz <rgm-sec@htt-consult.com>
Cc: IRTF CFRG <cfrg@irtf.org>
Content-Type: multipart/alternative; boundary="00000000000013ddf1059d3aa224"
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/R_SvdsGDHuYd5qqx3cU-DE3WywM>
Subject: Re: [Cfrg] ECDH subgroup attack question
Precedence: list

On Tue, Jan 28, 2020 at 4:46 PM Robert Moskowitz <rgm-sec@htt-consult.com>
wrote:

> In TLS 1.3, RFC 8446 sec 4.2.8.1 the testing range for Y is:
>
> 1 < Y < p-1
>
> In RFC 2785 sec 3.1, that references 2631, the range for Y is:
>
> "within the interval [2, p-1]"
>
> TLS 1.3 is more liberal, it seems to me, than 2785.
>

No, TLS 1.3 is more conservative, since it rules out p-1 (i.e., it allows
[2, p-2]).  This is more safe because p-1 generates the subgroup of order
two {p-1, 1}.

--Richard


>
> What is 'right' / 'safe'.
>
> Further 2785 has a second check:
>
> Compute y^q mod p. If the result == 1, the key is valid.
>
> Is this test still advised?
>
> thank you
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

[Cfrg] ECDH subgroup attack question Robert Moskowitz
Re: [Cfrg] ECDH subgroup attack question Andrey Jivsov
Re: [Cfrg] ECDH subgroup attack question Richard Barnes
Re: [Cfrg] ECDH subgroup attack question Robert Moskowitz
Re: [Cfrg] DH, not ECDH, subgroup attack question Robert Moskowitz
Re: [Cfrg] DH, not ECDH, subgroup attack question Peter Gutmann
Re: [Cfrg] DH, not ECDH, subgroup attack question Robert Moskowitz
Re: [Cfrg] DH, not ECDH, subgroup attack question Robert Moskowitz