Re: [Cfrg] Response to the Attacks on key agreement in SM2

[Watson Ladd <[e-mail]>]

On Tue, Feb 25, 2014 at 11:23 PM, Limin LIU <[e-mail]> wrote:
> Dear Watson,
>
>     This is Limin from the team of SM2 patent holder, Data Assurance and
> Communication Security Center in Chinese Academy of Sciences. Following is
> the response to your concern about the attacks on SM2. (Attacks on key
> agreement in SM2.
> http://www.ietf.org/mail-archive/web/cfrg/current/msg04297.html )
>
>     In Xu's (CANS 2011) paper, the attack towards SM2 key exchange protocol
> is launched in Canetti-Krawczyk model, where adversary could reveal private
> session state. To make the attack successful, the adversary should have the
> ability to reveal the state variable (x_v,y_v). (x_v,y_v) is the result of a
> computation from B's private key d_B, B's private random number r_B, along
> with other public parameters. The question here is, d_B and r_B are not easy
> to be obtained in real world. What's more, if the adversary has such kind of
> knowledge, he could already obtain the session key K_B by K_B =
> KDF(x_v||y_v||z_A||z_B,klen), it seems unnecessary to launch other attacks.
> Overall, this attack is academic crypto analysis based on strong
> assumptions. It's not a practical threaten to the algorithm.
>
>    Hope this could address your concerns. Any further comments will be
> greatly appreciated.

It doesn't. Instead of an analysis showing that in some reasonable
threat model SM2 security reduces to some reasonable assumptions, you
present an argument that the one attack I found in the literature
doesn't matter in practical applications. There is a large literature
and well-understood theory of key negotiation protocols, and I have
yet to see any demonstration that SM2 was designed with that in mind.

Sincerely,
Watson Ladd
>
> Best,
> Limin
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin