Re: [Cfrg] FIPS or equivalent approvals

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 29/07/2014 16:03, Phillip Hallam-Baker wrote:

> trustworthy HSMs

A mammoth problem, and not one I believe CFRG is really in a position
to solve.

Given EDGEHILL and BULLRUN and related concerns about the CESG/FIPS
validation processes, I feel a HSM/smartcard/token design actually
worthy of third-party trust would need:

• Open, transparent, public open-source design, from software down as
  far as practical - right down past the mask to the gate/process level
  if possible;

• To be publicly and independently tested, verified and verifiable;

• To be practically immune to all known or reasonably speculated
  attacks

No current vendor or product meets - or even comes close to meeting -
those criteria, as far as I am aware. [And if you think one does, or
intends to try, please let me know, as it is an area of interest!]

Since you'd be looking at a clean-slate design with a completely
different (dramatically open, nothing-up-my-sleeves) approach compared
to the (closed, black-box, relatively analysis-hostile) status quo of
current commercial crypto hardware, I see no good reason to be chained
to any particular legacy algorithm at all - let alone (EC)DSA.

In fact, I'd be tempted to suggest that one good approach might be to
make a (very) special-purpose, cut-down open-source CPU, with
verifiable design, well-defended (constant time & power; cacheless?
parity? Microcode-free?), and particularly good at the kind of
operations often used in crypto, pair it with a well-vetted NDRNG, and
then to write verifiable software for that base implementing the
actual algorithms. Minimises the trust base; maximises flexibility;
possibly could extend service life of the design. But I'm not sure it
falls within scope of this group.

Links which might be of some interest:
• https://cryptech.is/ - directly relevant; an attempt to do this
• https://sel4.systems/ - tangentially relevant; now open-source!
• http://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ - perhaps
  irrelevant exactly, but I found it interesting research anyway

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJT1+EZAAoJEOyEjtkWi2t6qbUQAK7jOqyoIq2tizyZ91raTsBG
cC46E7qsg0aR6o+WFmu8ZX9Hsl/A6GcqdyeS04j4wMn3q6fXXd2qKTrESYYO4tCM
22d9JsOReqqfBD6CodzYOZtAtrJXC5962Ae5XK+B6x5i59VLIbs6YHIBoBoHfwLd
q6aBHDnUH4SuyyEB14swpbdUFpw9VMcyEjLatdeF1Sfufaca2bPpGjXIdBZGzb3a
tyUUM3xKIvXfCrsUaIN3jeeh3vk2fOKzzeMioCntj+OVf8pnuCWbeCrQK13s4smH
wrYRWcN2o83fA0MbmhfN3ExnKFA/FlvqNlZ844roYh5OJAOAFJXQsSCDC5+2AOII
7yQCygXv00Zk1bEABHHV6jokcamRyts8EkoSYXfU3mFCTmPgtq674dKxl0O6jWtx
V7yydsi6dK/g2H+SWT7gXVKooxkJ5FHh4OaRZsY76sXxVx8rhc9c6tMl9TE5Ko/+
hB2yqCmZfrI4CwaLMsXHqOWq3gwYyqfUKM6UmTB+8/aeO9j37zSFjm4l9CcqJnXl
MOlPOO8ID8c3yMW4uOS+iGDOmM0RuMgNJ1LxC2rgZDLptJ4r7LiWaZA4fyEAQ8Zr
nM+EzVTtNwxP/Bh5oIRtUISUCznEU+B4nH9DXHJLOQXGd/0cisWDQLrqwnujaXib
BvS7ygZXI7XFmW3osnQs
=pbJf
-----END PGP SIGNATURE-----