Re: [TLS] Static DH timing attack

Peter Gutmann <pgut001@cs.auckland.ac.nz> Fri, 11 September 2020 02:21 UTC

From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Achim Kraus <achimkraus@gmx.net>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] Static DH timing attack
Thread-Index: AQHWhrp+9EGmAKHnM0S2YOV3OYQKzqlhmhsF//998wCAAZtd6g==
Date: Fri, 11 Sep 2020 02:21:04 +0000
Message-ID: <1599790864561.88777@cs.auckland.ac.nz>
References: <5595BB40-3AFD-4327-B7B7-5E63FFC594DD@akamai.com> <1599729784370.87441@cs.auckland.ac.nz>, <fff1a66a-0a49-cfbd-461a-c1d0ed3aeaaa@gmx.net>
In-Reply-To: <fff1a66a-0a49-cfbd-461a-c1d0ed3aeaaa@gmx.net>
Accept-Language: en-NZ, en-GB, en-US
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Sep 2020 02:21:06.0711 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 15d6b457-a26a-4731-c2f9-08d855f956c6
X-MS-Exchange-CrossTenant-Id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=d1b36e95-0d50-42e9-958f-b63fa906beaa; Ip=[130.216.95.208]; Helo=[uxcn13-tdc-b.UoA.auckland.ac.nz]
X-MS-Exchange-CrossTenant-AuthSource: HK2APC01FT058.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: ME2PR01MB5107
Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CAU17A13 smtp.mailfrom=pgut001@cs.auckland.ac.nz
X-Mimecast-Spam-Score: 0.002
X-Mimecast-Originator: cs.auckland.ac.nz
Content-Type: text/plain; charset="WINDOWS-1252"
Content-Transfer-Encoding: quoted-printable
Content-Language: en-NZ
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/SdWwCHxvieuL9QYTN3zt8K6m2nM>
Subject: Re: [TLS] Static DH timing attack
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Sep 2020 02:21:18 -0000

Achim Kraus <achimkraus@gmx.net> writes:

>Does using x25519 for ECDHE is significant less secure than using it with
>e.g. secp384r1?

The NIST curves AFAIK are never used that way, it's only done with 25519
(there was something about it in an OpenPGP draft, but I think GPG went
straight to 25519 and only used ECDSA for signatures).

What I'm specifically referring to is DH run sideways, as someone put it
during the X9.42 discussion, i.e. used in static-ephemeral mode to try and
make it work like it's RSA.

In all the code audits I've done of 25519 used that way, I've never seen it
used correctly.  Usually there isn't just one mistake made but many of them.
It's such an obvious problem that that and misuse of RC4-equivalent modes/
algorithms like GCM and ChaCha20 are the first things I look for in crypto
code.

Peter.

[TLS] Static DH timing attack Salz, Rich
Re: [TLS] Static DH timing attack Dmitry Belyavsky
Re: [TLS] Static DH timing attack Karthik Bhargavan
Re: [TLS] Static DH timing attack Peter Gutmann
Re: [TLS] Static DH timing attack Achim Kraus
Re: [TLS] Static DH timing attack Dan Brown
Re: [TLS] Static DH timing attack Hugo Krawczyk
Re: [TLS] Static DH timing attack Salz, Rich
Re: [TLS] Static DH timing attack Peter Gutmann
Re: [TLS] Static DH timing attack Peter Gutmann
Re: [TLS] Static DH timing attack Salz, Rich
Re: [TLS] Static DH timing attack Russ Housley
Re: [TLS] Static DH timing attack Filippo Valsorda
Re: [TLS] Static DH timing attack Peter Gutmann
Re: [TLS] Static DH timing attack Peter Gutmann
Re: [TLS] Static DH timing attack Filippo Valsorda
Re: [TLS] Static DH timing attack Lanlan Pan