Re: [Cfrg] ECDH subgroup attack question

Is there some external document to reference when providing this text in 
a draft's Security Considerations section?

Or is this 'so well known' now that putting it in the Security 
Considerations is all that is needed.

thanks

On 1/28/20 5:20 PM, Richard Barnes wrote:
>
>
> On Tue, Jan 28, 2020 at 4:46 PM Robert Moskowitz 
> <rgm-sec@htt-consult.com <mailto:rgm-sec@htt-consult.com>> wrote:
>
>     In TLS 1.3, RFC 8446 sec 4.2.8.1 the testing range for Y is:
>
>     1 < Y < p-1
>
>     In RFC 2785 sec 3.1, that references 2631, the range for Y is:
>
>     "within the interval [2, p-1]"
>
>     TLS 1.3 is more liberal, it seems to me, than 2785.
>
>
> No, TLS 1.3 is more conservative, since it rules out p-1 (i.e., it 
> allows [2, p-2]).  This is more safe because p-1 generates the 
> subgroup of order two {p-1, 1}.
>
> --Richard
>
>
>     What is 'right' / 'safe'.
>
>     Further 2785 has a second check:
>
>     Compute y^q mod p. If the result == 1, the key is valid.
>
>     Is this test still advised?
>
>     thank you
>
>
>
>     _______________________________________________
>     Cfrg mailing list
>     Cfrg@irtf.org <mailto:Cfrg@irtf.org>
>     https://www.irtf.org/mailman/listinfo/cfrg
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg