Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[Peter Gutmann <[e-mail]>]

Yaron Sheffer <[e-mail]> writes:

>I think we've been through all these arguments (on both sides of the issue)
>over the last week, with the exception of "ECC brittleness". Can you please
>clarify what you mean by that?

So with RSA-authenticated DH all you need to do is use a constant-time modexp
on the server when you sign and pre-encode the PKCS #1 expected result and use
a constant-time memcmp() on the client when you verify and you're OK.  If you
did that ten years ago then you're safe against pretty much everything that's
come along since then.

With ECDLP-based algorithms in contrast there's a whole range of issues you
need to take into account, the worst of which is the distressing propensity of
the DLP algorithms to leak the private key if you get even the tiniest detail
wrong.  Not only do you have to get all of these finicky details exactly
right, but every now and then someone points out a new issue that you then
need to retroactively patch into your existing code base.  For example if you
used the recommended (until not too long ago) way to generate your k for 
(EC)DSA then you'd leak a tiny bit of your private key on each signature
(again, that nasty propensity of DLP algorithms to leak the private key).
That's what I meant by ECC, and DLP in general, brittleness.

Peter.