[Cfrg] (flaws with Curve25519 DH function, if one does not check the output) Re: Elliptic Curves - curve form and coordinate systems

[Rene Struik <[e-mail]>]

Hi Ilara:

I do not understand this: if one uses k=H(X,Y,K), where X is one's own 
key contribution, where Y is the received one, where K the computed DH 
key using the Curve25519 function, and where H is a hash function, then 
taking for Y a point of order dividing the co-factor h=8 of the curve 
results in key K=0 and k=H(X,Y,0), .e., it is publicly computable.

Could you explain what you meant (or send some emergency morning coffee 
supplies)?

Best regards, Rene

On 3/16/2015 9:32 AM, Ilari Liusvaara wrote:
> On Mon, Mar 16, 2015 at 09:08:11AM -0400, Rene Struik wrote:
>> Hi Viktor:
>>
>> I *did* comment on the DH function, which, with Montgomery-style
>> specification as in the "Curve25519" draft, is completely insecure,
>> if one does not check the output to be nonzero.
> Just hashing in the exchange keys is enough, and every protocol
> should do this, except some do not (*cough* TLS *cough*).
>
> SSH does hash the exchange keys and thus can't be attacked via
> small subgroups, even if implementation doesn't check.
>
> Also, It gets even worse with finite-field DH, since if arbitrary
> fields are allowed, there is no realistic way to check, and even
> if fields are fixed, there are small subgroups.
>
>
> -Ilari


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]