Re: [TLS] Using Brainpool curves in TLS

On Fri, Oct 18, 2013 at 12:22 AM, Manuel Pégourié-Gonnard
<mpg@elzevir.fr> wrote:
> On 17/10/2013 18:40, Nico Williams wrote:
>> On Thu, Oct 17, 2013 at 11:25 AM, Manuel Pégourié-Gonnard
>> <mpg@elzevir.fr> wrote:
>>> On 17/10/2013 17:55, Nico Williams wrote:
>>>> The fact that some curve has twist
>>>> security means that for DH there's no need to validate that public
>>>> keys are points on the curve
>>>
>>> Not if your peer sends you (x, y). Your statement is true only in ECDH schemes
>>> where the peers sends only x (and you don't attempt to find y).
>>
>> Fair enough, but as the subject was Brainpool vs. Curve25519...
>
> If I may reformulate my point: twist-security is relevant only for curves
> suitable for use with schemes where only the x coordinate is transmitted, and no
> attempt to reconstruct y is needed on the receiving side. Which means, curves
> for which formulas exist for point multiplication using only the x coordinate.
> To the best of my knowledge (read: after looking up the explicit formulas
> database) no such formulas exist for short Weierstrass curves. Let's try with
> pseudo-code:
This isn't true: See Brier-Joye ladders. They aren't used because of
efficency problems, but they
solve the incompleteness issues.
>
> If (has efficient x-only formulas)
>         may transmit only x, and if doing so:
>                 if (is twist-secure)
>                         no need to validate x
>                 else
>                         need to validate x
> else
>         need to transmit or reconstruct y, so:
>         if (y transmitted entirely)
>                 need to validate (x,y) explicitly
>         else
>                 (x,y) implicitly validated while reconstructing y
>
> As you can see, twist-security is irrelevant in the second branch, to which
> short-Weierstrass curves (which can't be transformed to Montgomery form, such as
> Brainpool curves) belong unless some magical x-only formulas are discovered.
>
> So you may argue that Curve25519 has performance-without-sacrificing-security
> advantages for DH over Brainpool curves and I certainly won't contradict you on
> that point, but citing twist security as relevant here would be putting the cart
> before the horse IMO.
>
> Manuel.
>
> PS: just kidding (almost?), but one could argue that brainpoolP384r1, as used in
> TLS for ECDH now, is *less* secure because of twist-security, if people start
> thinking that they don't need to validate public keys for this curve...
Invalid curve attacks mean validation on short Weierstraß curves is
always required.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls


-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin