Re: [MLS] small subgroup validation

[Eric Rescorla <[e-mail]>]

The current drafts do require some validation, borrowed from Matt Green's
contributed text to TLS 1.3.

https://tools.ietf.org/html/draft-barnes-mls-protocol-00#section-6.1.1
https://tools.ietf.org/html/draft-barnes-mls-protocol-00#section-6.1.2

I haven't gone through this in detail in a while. Perhaps it's
insufficient? Or were you just making the general point that we should
state it for new curves?

-Ekr


On Tue, Feb 27, 2018 at 1:53 AM, Katriel Cohn-Gordon <[e-mail]>
wrote:

> Hi all,
>
> We should probably consider small subgroup attacks more carefully in the
> threat analysis and the draft documents.
>
> Specifically, computational proofs often implicitly assume point
> validation, which is particularly important in the case that a malicious
> group member sends an invalid copath element. I think the draft should
> state that point validation is required on all received group elements
> (unless using a group that doesn't require it); if I understand correctly
> this will cost roughly an additional exponentiation for each check, so
> O(log(n)) for a new and untrusted copath.
>
> [This was pointed out by Dennis Jackson.]
>
> best,
> Katriel
>
> _______________________________________________
> MLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mls
>