Re: [Cfrg] Switching the zero-check from MUST to MAY in the curves draft.

On Tue, Nov 17, 2015 at 9:16 AM, Taylor R Campbell
<campbell+cfrg@mumble.net> wrote:
>    Date: Mon, 16 Nov 2015 18:29:42 -0800
>    From: Mike Hamburg <mike@shiftleft.org>
>
>    > On Nov 16, 2015, at 18:01, Phillip Hallam-Baker <phill@hallambaker.com> wrote:
>    >
>    > Is there a mechanism that would allow an attacker to force use of
>    > all zeros?
>
>    Yes, an attacker can easily force it by sending specific values of
>    g^x, most of which cannot be produced by a legitimate
>    implementation.  There are something like 5 such values for
>    curve448 and 14 such values for curve25519.
>
> A malicious peer can do that, but so what?  A malicious peer can also
> use a secret key k known to an eavesdropper, and send k*B where B is
> the standard base point.  Then the eavesdropper seeing the good guy's
> public key h*B over the wire can readily predict k*h*B and find the
> session key.  A malicious peer could also email the session transcript
> to the eavesdropper.
>
> What is the serious attack that is prevented by a zero check?  It
> seems to me an answer to that question is more important than the
> choice of verb.

Some protocols require contributory behavior from DH exchanges.
Examples include TLS. Most protocol designers understood how to avoid
this, but TLS was not designed by a cryptographer. This went unnoticed
until very recently, when it was exploited in the Triple-Handshake
attack.

>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.