Re: [Cfrg] malicious DH base points [was Re: should the CFRG really strive for consensus?]

On Sat, Jan 3, 2015 at 3:48 PM, Adam Back <adam@cypherspace.org> wrote:
> On 3 January 2015 at 18:28, Paterson, Kenny <Kenny.Paterson@rhul.ac.uk> wrote:
>>>On Thu, 2015-01-01 at 13:39 +0100, Adam Back wrote:
>>>> Seems like on
>>>> topic and to the point, not spam.
>>
>> And as Adam Langley and others have pointed out, no-one seriously
>> believes that the choice of base point has any security impact (a more
>> refined statement about this to which I can subscribe can be found at the
>> bottom of the safecurves page here:
>
> Nevertheless I think it should be part of the NUMS generation.
>
> Apart from the academic paper which hypothesises a combined weakness
> between the generator and the KDF for key-exchange (which again, is
> NOT off-topic), there are situations where you need pairs of
> generators which no one knows the discrete log of (for example like
> EC_DBRG, a backdooring topic known to all; or u-prove/Brands
> representation problem a DL/ECDL schnorr-extension attribute
> certificate, which has multiple bases, probably there are other
> examples)
>
> If those are mixed with the main base point which is chosen using
> unexplained randomness, then it maybe that even if we use G (the main
> and non-NUMS base) plus H which given its intended to demonstrate lack
> of knowledge wrt to H, would be generated with NUMS, that still fails
> because maybe the person who generated G chose it such that it is the
> discrete log of H (or vice-versa -- its the same thing).
>
> I dont see what motive we can have for not NUMS the G parameter to for
> the avoidance of doubt - its not as if there's a big cost to that.

9 is the minimal x coordinate that gives a prime order point on the
Montgomery model of Curve25519. I just checked this a moment ago with
PARI, so there is no reason to view the NUMS generator as more rigid.

As for the two-generator protocols, I agree there are issues with how
one would generate two generators. But I've not heard serious
objections to using a hash function: it's the way that Certicom for
instance, generated challenges for finding discrete logs, or the way
that one would close the Dual_EC backdoor. It's true that the attack
you mentioned is possible if we simply pick a generator, and then try
to generate another point.

Sincerely,
Watson

>
> Adam
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin