Re: [Cfrg] Practical summary of ECDH in TLS regarding the curve features

[Andrey Jivsov <[e-mail]>]

On 07/27/2014 08:22 PM, Watson Ladd wrote:
> This is true. But why waste time making bad curves when we can make
> good ones?

Certainly. My 4-cell table of likely ephemeral key strategies for client 
and servers meant to show that the reuse of ephemeral DH is expected at 
least for TLS servers. Some TLS clients are actually (computer) servers 
connecting to many TLS servers, and so I am against prohibiting the 
reuse for TLS clients too.

This means that curves must be capable to handle static DH (i.e. reused 
ephemeral DH) and therefore good curves are beneficial for TLS.

The
> argument that side channels don't matter for signatures and ECDH
> ignores quite a few practical
> issues:
> -determinism in signatures lets you reuse a side channel by getting
> repeated signatures on the same message.
> -side-channels are not bounded: I could leak almost all the bits from
> a side channel, leaving a very small number
> to guess.

I wasn't looking at signatures, which use static keys.

I should clarify my comment about the side channel. I was thinking about 
a sidechannel in a network device sense (either a timing channel or an 
error channel).

It's true that if an ECDH scalar multiplication leaks reliably whether 
or not it does double or add, a single ECDH operation implemented that 
way might be hypothetically sufficient to recover the scalar. Would it 
end up in the same feasibility bucket as the 0.866*2^128 ECDLP attack?