Re: [Cfrg] Switching the zero-check from MUST to MAY in the curves draft.

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

On one hand, an RFC describes a protocol, not an implementation. On the
other hand, having an implementation that does not check for zero in DH
sounds strange, to say the least.

If you don’t want to use the IETF term “MUST” (or “SHOULD”), perhaps you
can just say that “not checking for zero can lead to catastrophic security
failures, and it is responsibility of the application developer to make
sure it doesn’t happen”…
-- 
Regards,
Uri Blumenthal





On 11/16/15, 18:03 , "Cfrg on behalf of Adam Langley"
<[e-mail] on behalf of [e-mail]> wrote:

>At the moment, the curves draft says that implementations MUST check
>for the all-zero output and abort if it's found, at least in
>Diffie-Hellman. The all-zero output results when the input point has
>small order and this sort of thing has, in the past, broken at least
>Tor and TLS channel bindings.
>
>While reactions on the list were ambivalent to the suggestion, I had
>hoped that implementations would take this requirement as a simple
>defence-in-depth measure in keeping with the general robustness theme
>of this work.
>
>I was mistaken. It's since become clear that some disagree
>sufficiently strongly about this that we aren't going to see a
>realignment of implementations around this behaviour. While I still
>think that it's a sensible requirement, RFCs that are prescriptive
>rather than descriptive are terrible and so I currently hope to switch
>from MUST to MAY once the draft has completed the editor's queue.
>Instead, some wording would be added to the Security Considerations
>section.
>
>This change contains the accumulation of tweaks that I currently have
>saved up, including this one:
>https://github.com/agl/cfrgcurve/commit/c7749d4bb5ceabdb30f211d4aaa6df2b68
>d7c5e1
>
>This email is notice that I currently plan on making this change. Note
>that the question here isn't whether the zero check is a good idea or
>not. Rather it's that, given that a non-trivial number of
>implementations aren't going to implement it, what's the best thing to
>write?
>
>
>Cheers
>
>AGL
>
>-- 
>Adam Langley [e-mail] https://www.imperialviolet.org
>
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>https://www.irtf.org/mailman/listinfo/cfrg