Re: [Cfrg] Security proofs v DH backdoors

["Paterson, Kenny" <[e-mail]>]

Hi Dan,

Bringing this thread back to where it started...

On 25/10/2016 14:30, "Cfrg on behalf of Ilari Liusvaara"
<[e-mail] on behalf of [e-mail]> wrote:

>On Tue, Oct 25, 2016 at 01:10:16PM +0000, Dan Brown wrote:
>> How do the 3 recent IACR eprints on FFDH backdoors‎ reconcile with
>> past security proofs for TLS, SSH, etc?
>> 
>> Some guesses: (1) the attacks are outside the security definitions
>> (=> attacks not so important?), (2) the proofs assume strong FFDH
>> groups plus validation, etc.
>
>I guess the proofs assume strong FFDH groups, such that dlog and
>dh attacks are infeasible.

I can confirm that this is the correct explanation, at least for TLS.

For example, the security proof* for static DH ciphersuites in [1, Section
7] assumes that a certain CDH-like assumption holds (specifically, the
PRF-ODH assumption, which concerns the combination of the KDF used in TLS
and the DH problem).

This assumption is stronger than the assumption that the DLP is hard in
the specific group in which the protocol is run.

The proof in [1] also assumes group membership tests are carried out
(which, as has been discussed on this thread, is a problem for TLS, where
the server cannot tell the client anything about the group, not even its
claimed order). 

In the group instances under discussion, PRF-PDH is not hard for an
adversary who has the trapdoor/backdoor information.


Cheers,

Kenny 

---
*Other proofs for this and other modes are available in the literature.

[1] Hugo Krawczyk, Kenneth G. Paterson, Hoeteck Wee: On the Security of
the TLS Protocol: A Systematic Analysis. CRYPTO (1) 2013: 429-448



>
>I think there was one TLS implementation that tries to verify the
>groups sent (of course, not all can be verified, even if those
>aren't maliscously constructed).
>
>And the backdoors in one of the papers was about constructing
>prime such that one can use faster special case for dlogs. That
>can't be easily discovered, even if one somehow can obtain the
>group order. So one can't validate against it.
>
>
>-Ilari
>
>
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>https://www.irtf.org/mailman/listinfo/cfrg