Re: [Curdle] Looking for comments on draft-ietf-curdle-ssh-kex-sha2

[Hubert Kario <[e-mail]>]

On Tuesday, 18 August 2020 07:42:40 CEST, Ron Frederick wrote:
> On Aug 17, 2020, at 3:34 PM, Mark D. Baushke <[e-mail]> wrote:
>> Ron Frederick <[e-mail]> writes: ...
>> That said, there are many who have been doing research which seems to
>> show that ECC is easier to break with Quantum Crypto systems than FFC
>> and are NOT interested in implementating ANY ECC algorithms.
>> 
>> I believe I have seen some text from implementers who have said they
>> would NOT adopt ECC for their SSH implementations.
>
> That’s interesting - I hadn’t read that. I was aware of 
> concerns about potential compromises in the nistp curves, but 
> not specifically about Quantum attacks against ECC.

basically it boils down to the size of the field, with 256 bit field you
need 384 qbit QC, with 2048 bit field you need 3072 qbit QC to break it

so ECC will be broken before RSA/DH/DSA of similar classical level of 
security

the open question is how much time RSA/DH will have over ECC

>> - I’m also thinking diffie-hellman-group15-sha512 might be a good
>>>  candidate for a SHOULD rather than a MAY, but I’m not sure we have
>>>  consensus on that.
>> 
>> Yup, I have not seen any consensus on this issue as yet.
>> 
>> Perhaps we should opt to make diffie-hellman-group-exchange-sha256 a
>> MUST? This allows implementors to put in whatever MODP groups they wish
>> as long as q = (p-1)/2 ... so, a maximized q-ordered subgroup... though
>> I o worry a bit about the way that the generator g is created perhaps
>> not providing that g^q mod p == 1 is a will formed subgroup. When it is
>> not a well-formed subgroup, then it will be leaking the first bit of the
>> key value.
>
> That’s an interesting thought. Are there “best practices” which 
> could be followed in generating/validating  these values that 
> could avoid such a weakness?

if the p is a safe prime, then "a bad" generator can leak one bit of the 
private
key, but it can leak at most one bit of private key; you can guess that bit
with a 50% chance of being right anyway, that does not translate to an 
attack

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic