Re: [Cfrg] Proposed requirements for curve candidate evaluation

[David Jacobson <[e-mail]>]

On 8/8/14 11:06 AM, D. J. Bernstein wrote:
> Brian LaMacchia writes:
> <snip>
>> 4. When evaluating candidate curves for use in ECDHE, "ephemeral"
>> should be defined as "use exactly once in a key exchange" (or for TLS
>> "use in exactly one handshake").
> https://www.imperialviolet.org/2013/06/27/botchingpfs.html explains how
> keys can be kept around for months---despite meeting your definition of
> "ephemeral". These keys are clearly _not_ ephemeral and do _not_ provide
> perfect forward secrecy.
>
> As I explained in a previous message, "use for exactly one session" is
> the wrong policy; "use for exactly one connection" is the wrong policy;
> and Microsoft's current reuse-for-two-hours is also the wrong policy.
> These all fail to accomplish what the user wants, namely for keys to be
> erased very soon---I suggested 10 seconds as an upper limit.
> <snip>
> ---Dan
>
Dan is actually doing something much more fundamental that one might at 
first think.  He is changing the threat model.

Most people probably have the idea that ephemeral keys are more secure 
that longer term keys because they limit they amount of data relating to 
a particular key that a passive eavesdropper has access to, and thus 
make a cryptanalytic attack harder.  (I had that idea.)  But Dan is 
changing the treat model.    The threat is an attacker who can from time 
to time grab some amount of system state.  By Little's Law, the mean 
number of sensitive keys in the system is the throughput (sessions 
established per second) times the mean residence time of each key (in 
seconds), so the shorter the residence time, the fewer keys are there to 
get snitched.

Note that this depends on attacks grabbing some system info from time to 
time, perhaps by something like Heartbleed.  It also applies to things 
like the system state getting paged to swap, or written out in a crash 
dump.  It does not apply to an attacker who has thoroughly gotten 
control of the system and can grab and export data from every crypto 
operation.  In that scenario, the attacker gets everything, and 
shortening the residence time provides no benefit. (This is not an 
argument against Dan's proposal, rather just an observation.)

      --David Jacobson