Re: [TLS] Curve25519 in TLS and Additional Curves in TLS

[Nikos Mavrogiannopoulos <[e-mail]>]

On Thu, 2014-04-10 at 21:28 +0100, Alyssa Rowan wrote:

> > And how does this affect an ephemeral key exchange?
> Assuming all side-channel attacks require repetition seems like the
> kind of rather dangerous thinking that has bought TLS very unpleasant
> surprises in the past. We've had quite enough of those already, I think.

Could you elaborate on how to achieve repetition on a protocol that runs
only once with the same key? I find your argumentation hard to follow.

> Curve25519 was designed _specifically_ so that it can use a lovely,
> extremely fast, constant-time Montgomery ladder: if you're not using
> that, frankly, you're doing it wrong. (Section 5 of the draft already
> addresses that, on my reading.)

I never questioned that, it will be very appropriate when one can use it
with static keys (i.e., ECDH - which are not in this draft). My comment
is for the existing draft that uses the curve for an ephemeral key
exchange, and were directed to the overplay of the relevance of constant
time (as you do here) without understanding whether it is relevant for
the threats on the protocol under discussion. So to recap, being
constant time is a good thing, but not very relevant for ECDHE.

regards,
Nikos