Re: [TLS] Twist security for brainpoolp256r1

[Manuel Pégourié-Gonnard <[e-mail]>]

On 13/11/2014 16:42, Watson Ladd wrote:
> On Thu, Nov 13, 2014 at 1:21 AM, Manuel Pégourié-Gonnard
> <[e-mail]> wrote:
>> On 13/11/2014 07:35, Oleg Gryb wrote:
>>> Thanks, very helpful. Just to summarize yours and Manuel's notes in regard of
>>> quadratic non-residue, or non-quadratic twists (as they are called in other
>>> emails), they can be used as a source of malicious EC points to run
>>> invalid-curve attacks on the original curves, but since all implementations
>>> compliant with X9* standards including openssl must have point-on-curve
>>> validation, invalid-curve attacks and small-group attacks become irrelevant
>>> when it comes to brainpoool's openssl implementation.
>>
>> The situation is actually a bit more complex. Here is a version that's still a
>> bit simplified but closer to the truth: let's say there are two kinds of
>> protocols (or curve representations):
>>
>> 1. Those who use both coordinates of the points.
>> 2. Those who use only the x coordinate.
> 
> The coordinates used on the wire do not determine the calculations
> used by an implementation.

Sure. That's why I said that the above was still a bit simplified.

> An interoperable implementation of TLS
> could use the Brier-Joyce ladder on x-coordinates only, and take a
> randomly chosen square root for use as the y-coordinate, validating
> signatures through a different method. This would be of interest in
> certain side-channel attack scenarios, as the Brier-Joyce ladder is
> easier to protect.
>
I hope that an implementer who knows this somewhat exotic option and chooses to
use it for its side-channel properties is also sufficiently knowledgeable and
security concious to properly validate points...

> Most implementations don't do this, so the rest of your email is correct.
> 
Thank you.

Manuel.