Re: [Cfrg] Switching the zero-check from MUST to MAY in the curves draft.

I think that your description fits 'SHOULD' more than 'MAY', given that the
expanded Security Considerations imply that "the full implications must be
understood and carefully weighed" before not checking for an all-zero
output.

On Mon, Nov 16, 2015 at 6:12 PM Blumenthal, Uri - 0553 - MITLL <
uri@ll.mit.edu> wrote:

> On one hand, an RFC describes a protocol, not an implementation. On the
> other hand, having an implementation that does not check for zero in DH
> sounds strange, to say the least.
>
> If you don’t want to use the IETF term “MUST” (or “SHOULD”), perhaps you
> can just say that “not checking for zero can lead to catastrophic security
> failures, and it is responsibility of the application developer to make
> sure it doesn’t happen”…
> --
> Regards,
> Uri Blumenthal
>
>
>
>
>
> On 11/16/15, 18:03 , "Cfrg on behalf of Adam Langley"
> <cfrg-bounces@irtf.org on behalf of agl@imperialviolet.org> wrote:
>
> >At the moment, the curves draft says that implementations MUST check
> >for the all-zero output and abort if it's found, at least in
> >Diffie-Hellman. The all-zero output results when the input point has
> >small order and this sort of thing has, in the past, broken at least
> >Tor and TLS channel bindings.
> >
> >While reactions on the list were ambivalent to the suggestion, I had
> >hoped that implementations would take this requirement as a simple
> >defence-in-depth measure in keeping with the general robustness theme
> >of this work.
> >
> >I was mistaken. It's since become clear that some disagree
> >sufficiently strongly about this that we aren't going to see a
> >realignment of implementations around this behaviour. While I still
> >think that it's a sensible requirement, RFCs that are prescriptive
> >rather than descriptive are terrible and so I currently hope to switch
> >from MUST to MAY once the draft has completed the editor's queue.
> >Instead, some wording would be added to the Security Considerations
> >section.
> >
> >This change contains the accumulation of tweaks that I currently have
> >saved up, including this one:
> >
> https://github.com/agl/cfrgcurve/commit/c7749d4bb5ceabdb30f211d4aaa6df2b68
> >d7c5e1
> >
> >This email is notice that I currently plan on making this change. Note
> >that the question here isn't whether the zero check is a good idea or
> >not. Rather it's that, given that a non-trivial number of
> >implementations aren't going to implement it, what's the best thing to
> >write?
> >
> >
> >Cheers
> >
> >AGL
> >
> >--
> >Adam Langley agl@imperialviolet.org https://www.imperialviolet.org
> >
> >_______________________________________________
> >Cfrg mailing list
> >Cfrg@irtf.org
> >https://www.irtf.org/mailman/listinfo/cfrg
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>