Re: [TLS] Should we require compressed points

[Manuel Pégourié-Gonnard <[e-mail]>]

On 31/10/2014 19:31, Ilari Liusvaara wrote:
> On Fri, Oct 31, 2014 at 10:34:52AM -0700, Eric Rescorla wrote:
>> This discussion seems to be settling, so I've prepared a pull request
>> that implements Bodo's suggestion:
>>
>> https://github.com/tlswg/tls13-spec/pull/86
>  
> I think 8.1.2 (ECDHE premaster secret calculation) should be modified
> as well, to specify using the fixed wire encoding of selected group for
> premaster secret.
> 
Just to be clear: this would change the way the PMS is computed for the existing
curves, right? I'm not opposed to it, I just want to make sure we're on the same
line.

> This is to avoid problems with more "odd" encodings.
> 
I think this is indeed a very desirable outcome, that is achieved by your proposal.

> Note that 8.1.1 does not quite match that beheviour, since it specifes
> leading zero octets to be stripped (whereas DHE "element" encoding
> doesn't seem to specify if zeroes are stripped or not)
> 
I think it makes sense to accept non-canonical representation of DHE elements as
long as it's not ambiguous (be liberal in what you accept), while for the PMS
it's necessary to be strict in order to ensure interop. But I wouldn't be oppose
to something like "DHE elemens MUST be encoded without leading zeroes, but
implementations MAY accept leading zeroes in their encoding".

Manuel.