[CFRG] Re: I-D Action: draft-irtf-cfrg-rsa-guidance-01.txt

[Alicja Kario <[e-mail]>]

On Thursday, 5 September 2024 19:21:39 CEST, Phillip Hallam-Baker wrote:
> Very interesting. RSA will be with us for a long time...
>
> Have you considered key generation? Just adding a reference to 
> FIPS 185-5 might be enough. I am currently trying to decide 
> whether probabilistic or provable primes are the way to go. I 
> have also noticed that keygen on my state of the art 2023 
> machine is taking almost as long as it used to take in 1990. 
> That is because we are using longer keys and we are doing a lot 
> more checks - the auxiliary primes.

RSA key generation is a very rare occurance, so it's easier to just
do it offline, on a trusted system, than to work to make it side
channel safe. So, no, I consider it out of scope.

> On the draft itself, I am not sure about calling Montgomery 
> ladders 'side channel free'. They are really not. Hardware does 
> too much weirdness these days for anything to be side effect 
> free unless it is hardware designed to be so.

I'm suggesting Montgomery ladder not because it's inherently side-channel
free—it's not, as the draft explicitly states—but because it's one of
the easiest ones to make side-channel free.

While special hardware may help, I haven't seen that it's actually
necessary on general purpose systems: my team and I have verified multiple
implementations of RSA decryption to be side-channel free to
sub nanosecond resolution. Same for particular big-int arithmetic
primitives. For CPU scheduler, having operations that take the same amount
of time makes handling the CPU state much easier, so I don't think
it's so far fatched of a result.

Honestly, I suspect that a lot of the "weirdness" you refer to comes
from badly designed test scenarios, not actual lack of determinism
in the hardware.

And while yes, we can have a situation where multiplying zeros over and 
over
will take less energy than multiplying random values over and over, and
that can bleed into the CPU frequency, and thus be visible in the
timing side channel, it's not something I have observed for the typical
RSA key sizes, let alone something that's a valid attack vector for RSA.

> On Tue, Sep 3, 2024 at 2:27 PM Alicja Kario <[e-mail]> wrote:
> Hello,
>
> In the main body of the draft there were just few minor changes:
> few typos fixed.
>
> The main change in revision 01 is the addition of actual test vectors
> for the 2048 bit RSA key.
>
> As I've also wrote automated tests to verify the correctness of them,
> it took me a bit more than I expected, you can find those here:
> https://github.com/tlsfuzzer/tlslite-ng/pull/528
> That's also the reason why I haven't added test vectors for other
> key sizes yet.
>
> Please provide comments if this format of the test vectors is
> OK/acceptable, and I'll add the other key sizes a bit later.
>
> On Tuesday, 3 September 2024 20:13:17 CEST, [e-mail] wrote:
>> Internet-Draft draft-irtf-cfrg-rsa-guidance-01.txt is now 
>> available. It is a
>> work item of the Crypto Forum (CFRG) RG of the IRTF.
>>
>>    Title:   Implementation Guidance for the PKCS #1 RSA 
>> Cryptography Specification
>>    Author:  Alicja Kario
>>    Name:    draft-irtf-cfrg-rsa-guidance-01.txt
>>    Pages:   23
>>    Dates:   2024-09-03
>>
>> Abstract:
>>
>>    This document specifies additions and amendments to RFC 8017.
>>    Specifically, it provides guidance to implementers of the standard to
>>    protect against side-channel attacks.  It also deprecates the RSAES-
>>    PKCS-v1_5 encryption scheme, but provides an alternative depadding
>>    algorithm that protects against side-channel attacks raising from
>>    users of vulnerable APIs.  The purpose of this specification is to
>>    increase security of RSA implementations.
>>
>> The IETF datatracker status page for this Internet-Draft is:
>> https://datatracker.ietf.org/doc/draft-irtf-cfrg-rsa-guidance/
>>
>> There is also an HTMLized version available at:
>> https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-rsa-guidance-01
>>
>> A diff from the previous version is available at:
>> https://author-tools.ietf.org/iddiff?url2=draft-irtf-cfrg-rsa-guidance-01
>>
>> Internet-Drafts are also available by rsync at:
>> rsync.ietf.org::internet-drafts
>>
>>
>

-- 
Regards,
Alicja (nee Hubert) Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00, Brno, Czech Republic