Re: [Cfrg] Security proofs v DH backdoors

[Hanno Böck <[e-mail]>]

On Fri, 28 Oct 2016 09:36:07 +0000
Peter Gutmann <[e-mail]> wrote:

> Secondly, DH's replacement, the ECC algorithms, are an absolute
> non-starter in any kind of harsh environment.  They're the most
> brittle crypto you can possibly deploy, any fault of any kind
> inevitably ends up leaking the private key.  I know several
> industries who, despite its great trendiness, won't touch the ECC
> stuff because it's just too brittle to safely use.

Can you elaborate what brittleness you mean? Because based on what I
know I come to a different conclusion. I think modern ECC is less
brittle than DH.
Reading the past 4 papers on DH (+ maybe logjam and 3shake) should be
enough to tell everyone that DH has a lot of brittleness in it.

Brittleness of ECC:
I'm aware of invalid curve attacks, which can be completely mitigated
by using a twist-secure curve and point compression as far as I'm
aware. Then there's the issue of ECDSA bad randomness (which affects
classic DSA in the same way), but it's irrelevant for key exchanges.

> Finally, specifically for the Bernstein protocol suite [0] if that's
> what you're thinking of for supplanting DH, it's easy enough for
> someone like Google to decree that from now on we all have to use X,
> but many industries are heavily constrained and regulated and can't
> just adopt whatever new algorithm comes along.

So your general idea here is that there are situations where people are
constrained not to use ECC with another curve, but they *can* use DH
with another parameter set?

I mean I can imagine that this happens (there's probably some
certification out there mandating specific curves and allowing
arbitrary DH parameters), but only in situations free of any
cryptographic knowledge.


But if there's a need for DH parameter sets: RFC 7919 has just been
published recently and was already mentioned in this thread. Would it
satisfy the needs of people if there simply was some kind of document
(could be an RFC, but maybe also just an errata) saying that the DH
parameters from 7919 may be used outside TLS? (not sure if this has to
be explicitly stated, but if it helps people, why not?)


-- 
Hanno Böck
https://hboeck.de/

mail/jabber: [e-mail]
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42