Re: [TLS] Safe ECC usage

Michael StJohns <msj@nthpermutation.com> Fri, 18 October 2013 16:35 UTC

Return-Path: <msj@nthpermutation.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3663D11E831B for <tls@ietfa.amsl.com>; Fri, 18 Oct 2013 09:35:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.799
X-Spam-Level:
X-Spam-Status: No, score=-2.799 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, SARE_BAYES_5x8=0.8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pG8qU-7twKxg for <tls@ietfa.amsl.com>; Fri, 18 Oct 2013 09:35:50 -0700 (PDT)
Received: from mail-qc0-f173.google.com (mail-qc0-f173.google.com [209.85.216.173]) by ietfa.amsl.com (Postfix) with ESMTP id CD08121F89A5 for <tls@ietf.org>; Fri, 18 Oct 2013 09:35:49 -0700 (PDT)
Received: by mail-qc0-f173.google.com with SMTP id l13so2821733qcy.18 for <tls@ietf.org>; Fri, 18 Oct 2013 09:35:48 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=BQ5H+KhAzMo+s2jSHHwObPIij67t/8seJjXcKYcvG64=; b=hfUF0O4oLy/CHNVrfNfps7s7pCRVeVzJrthE1WgtzlykgQxebaqN5KPJ83kDfG2U6Z w7ROfl6ESSXQZV6kOYaWU2WH2c6KUv0a00G81E/FAPYoAG666hdDzj/De+UVmBscuXjv ubbKganlj+glp5f90pQaOZP1Y6G11flICUfnTMDBfrj6k+b8Gq+ov8OJSrRELnPR4hCS EhnvFqx2whS2/lfqM0wxObtZ+QcjP7YG9gqOhuUcXayYrSbktWnZtuvBH4lyeLiW9zFU j6kGtOxiLDF16nD4M+uQOFySrHSNtk5EhUL4Qm4vkdRJezFalcQbstuYH4fvt9ZCi4rV nSjw==
X-Gm-Message-State: ALoCoQkimbx48YM0wR5BtJTU91oZPJjFIldXH3IbidDpz0D67DNWMZglOm3wPgN8oNjdx/3ZQ+CT
X-Received: by 10.49.47.84 with SMTP id b20mr5088522qen.83.1382114148409; Fri, 18 Oct 2013 09:35:48 -0700 (PDT)
Received: from [10.90.197.74] (soi.silverspringnet.com. [74.121.22.10]) by mx.google.com with ESMTPSA id x1sm7005134qai.6.2013.10.18.09.35.47 for <tls@ietf.org> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 18 Oct 2013 09:35:47 -0700 (PDT)
Message-ID: <52616365.1080108@nthpermutation.com>
Date: Fri, 18 Oct 2013 12:35:49 -0400
From: Michael StJohns <msj@nthpermutation.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0.1
MIME-Version: 1.0
To: tls@ietf.org
References: <523E176F.3050304@gmail.com> <9A043F3CF02CD34C8E74AC1594475C7355674EE0@uxcn10-6.UoA.auckland.ac.nz> <20130926152757.15842.qmail@cr.yp.to> <810C31990B57ED40B2062BA10D43FBF5BDB49B@XMB116CNC.rim.net> <20130928223648.1113.qmail@cr.yp.to> <20130929025714.5578895.47771.4422@certicom.com> <20131001143511.11010.qmail@cr.yp.to> <810C31990B57ED40B2062BA10D43FBF5BDE21E@XMB116CNC.rim.net> <20131002161944.8125.qmail@cr.yp.to> <810C31990B57ED40B2062BA10D43FBF5BDE90F@XMB116CNC.rim.net> <20131003010455.17185.qmail@cr.yp.to> <810C31990B57ED40B2062BA10D43FBF5BDECA6@XMB116CNC.rim.net> <20131005192950.27059.qmail@cr.yp.to> <810C31990B57ED40B2062BA10D43FBF5BE4A9D@XMB116CNC.rim.net> <20131012003058.669.qmail@cr.yp.to> <810C31990B57ED40B2062BA10D43FBF5BEBAA5@XMB117CNC.rim.net> <CACsn0c=bSTMWwuHxD3eE3ABC_AxVRt-BOTybEr7umPQD5NB+cA@mail.gmail.com> <810C31990B57ED40B2062BA10D43FBF5BEC2EC@XMB117CNC.rim.net>
In-Reply-To: <810C31990B57ED40B2062BA10D43FBF5BEC2EC@XMB117CNC.rim.net>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: Re: [TLS] Safe ECC usage
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Oct 2013 16:35:55 -0000

I've been watching the curve conspiracy discussion stuff for a bit. I 
don't actually know what the reality is.  So I decided to try and find 
the earliest mention of one of the seeds.  I half expected I was going 
to find the seed string had been pulled from the random number tables in 
the CRC handbook.

I googled for "C49D3608 86E70493 6A6678E1 139D26B7 819F7E90" - the seed 
for P256 and found:

ftp://ftp.iks-jena.de/mitarb/lutz/standards/ansi/X9/x962-11-17-97.pdf

This document has the seed for P256 and P192 (which also matches) but 
not P384 or P521. Only sample curves up to 256 bits were provided.

The existence of this document, created in 1997 would tend to suggest 
that at least a few curves were created in X9 and not by NIST given the 
document precedes the FIPS 186-2 publication by a couple of years.  Of 
course, X9 could have just gotten the curves from NIST as a submission - 
but why weren't P384 and P521 provided at that point?

  I don't have access to the X9 archives - maybe someone out there has a 
set of X9 correspondence around 1997 or so that we could take a look 
at?  I would expect the curves to be some form of specific contribution.

Mike