Re: [TLS] Curve25519 in TLS and Additional Curves in TLS

[Nikos Mavrogiannopoulos <[e-mail]>]

On Wed, 2014-04-09 at 08:00 -0700, Watson Ladd wrote:

> In fact, because you are the GnuTLS developer, I know exactly what
> your bignum library, gmp does. And it isn't pretty: operations can
> take different paths depending on argument size, which includes
> lopping off zero limbs. Modulo is computed by division, which involves
> an instruction that is notoriously variable-time on many
> architectures.

And how does this affect an ephemeral key exchange? I'll reply for you.
It has no effect, because it is an ephemeral key exchange.

Being constant time, _matters_ when you do operations on a long-term
key, not when you do one operation on a one-time-key. So in the cases
where it matters nettle (the crypto library used by gnutls), is constant
time, and outperforms all other implementations so far.

> Your bignum implementation is also slow. 

See the point above. I'd be interested to know how you figured that gmp
is slow.

btw. I never mentioned implementing curve25519 using gmp or otherwise,
because I am not going to implement the low level part of it. That's why
I asked input from other who plan to implement it. 

> If you do decide to persist in this folly, reversing the bytes won't
> stop you, sadly. But I wish it could.

Please keep your poison for yourself.

regards,
Nikos