Re: [TLS] Curve25519 in TLS and Additional Curves in TLS

[Manuel Pégourié-Gonnard <[e-mail]>]

On 11/04/2014 09:33, Nikos Mavrogiannopoulos wrote:
> On Thu, 2014-04-10 at 21:28 +0100, Alyssa Rowan wrote:
> 
>>> And how does this affect an ephemeral key exchange?
>> Assuming all side-channel attacks require repetition seems like the
>> kind of rather dangerous thinking that has bought TLS very unpleasant
>> surprises in the past. We've had quite enough of those already, I think.
> 
> Could you elaborate on how to achieve repetition on a protocol that runs
> only once with the same key? I find your argumentation hard to follow.
> 
I think Alyssa's point was not that you can achieve repetetion, but that
progress in the attacks may some day lead to powerful attacks that don't need
repetition at all.

How much information the attacker can get in one pass depends on many factors,
such as the attacker's abilities (noised timing only and real-time power trace
are very different settings) and the implementation techniques. With a naive
double-and-add algorithm (on a short Weierstrass curve, no using unified
formulas) and an attacker able to get a precise enough power trace, I don't
believe the attacker needs repetition to get the full ephemeral key.

Of course this is a fairly extreme example, but I think it shows side-channels
are not entirely irrelevant for ephemeral keys, at least in some contexts.

That said, I agree that side-channels are probably much less of a threat for
ephemeral keys than for long-term keys in most settings.

Manuel.