IETF Logo Mail Archive

Re: [TLS] draft-ietf-tls-curve25519-01: Is public key validation necessary or helpful?

Brian Smith <brian@briansmith.org> Thu, 31 December 2015 00:47 UTC

Return-Path: <brian@briansmith.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D36A1A0173 for <tls@ietfa.amsl.com>; Wed, 30 Dec 2015 16:47:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.278
X-Spam-Level:
X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wvpgkOdy-PP5 for <tls@ietfa.amsl.com>; Wed, 30 Dec 2015 16:47:21 -0800 (PST)
Received: from mail-oi0-x22a.google.com (mail-oi0-x22a.google.com [IPv6:2607:f8b0:4003:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5834F1A016C for <tls@ietf.org>; Wed, 30 Dec 2015 16:47:21 -0800 (PST)
Received: by mail-oi0-x22a.google.com with SMTP id y66so209955188oig.0 for <tls@ietf.org>; Wed, 30 Dec 2015 16:47:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=briansmith-org.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=/je4jzKinUP6hnLcsbx+zyM3PfmdJg5YIjNEwAmVQ7M=; b=OyaPt0Z/7V2EVmB+PLysVu83mTVPUwGZuzNIRY8GPEXr0wtbr5iSKT8fsZ2kuHjuMI NbA3/kwpVs72XC7tjFHacJq3yTtjNVyLoqCm18j069nnwxiA8kWezh3cWd9zr2wayKhO F7bDnNzXYRuMJQInLg6IAvNMp1WSuxlEm4hkDei/DLuRst9JCEgyOHcolVLBaiR8NkB8 hEk3uwq93QQde3CSmERp5CjywZLrIh7gSdr8AcK0XL3XSjbx5+AN3OevdpjjtLRDCQix BU+xSZx3+k5+swWJ05NZ+mgYZA9BMWC4Y5iCbDmVO9eB4MjjZoUr3c9nTdKnSfbxmmYe a2aw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=/je4jzKinUP6hnLcsbx+zyM3PfmdJg5YIjNEwAmVQ7M=; b=GPrBl9flQOD6d/HBeigcR+RK8+alMBKVnjAZekY/oPRijf2lGVJXZfj3CwuJvBLH2O sLE6RbrTsaQRcCnxfAIQyJuyyc95WRdQE9BiTG3XDoqBIpvFjkfRz15iSE/vSdh2AEIR vb7mTKSsXQ2wCCOHmLUCIDn2onlMTxHpX50eFPYpjbhl5CVq4D6H+Qck3bkuao5YBLi5 ov/pfJzLlPy2BrZ2MUkyFOH159i8lLwhb+2X8nLwA+UFszI7qfM9N/icAigcooZ3cWo3 NEpzx8ovRIqlRyykudPnzh5xJHuUHKy8LBy2F4VcD39Fd6LDgPnN4gI3dW0VY8qUapln vQHQ==
X-Gm-Message-State: ALoCoQnfdoeU8TkGNeL9hhd4sqEPTSrM9uUKak+sf2uWq0DzX6iNSksmGe564g6THQjDUYR3r1E6dM7gkYXFxK4Wj6Ultgo4eA==
MIME-Version: 1.0
X-Received: by 10.202.189.7 with SMTP id n7mr42626884oif.55.1451522840701; Wed, 30 Dec 2015 16:47:20 -0800 (PST)
Received: by 10.76.62.8 with HTTP; Wed, 30 Dec 2015 16:47:20 -0800 (PST)
In-Reply-To: <CACsn0c=Wmy9oqnDFuhBY-YUSSYv2Wf-Wf09he+vjwvko=eciFg@mail.gmail.com>
References: <CACsn0cng1o-5hm=zuL6puOGJ8A2bjB=fFsaFsBCmmVofNSuumg@mail.gmail.com> <CABkgnnXQS3Ek6jDjx0aSQmaf+=EjfGWa8MG1AO4QwhJbK50VQg@mail.gmail.com> <CAFewVt4NSGDP_At8XsX4OsxSUaj_2kRyFP_keDQhfnR0=mBhrg@mail.gmail.com> <CABkgnnUq0_28U6VqE=ZPpwutOBUkTGwhxqHQOEvQve5JYfSVRA@mail.gmail.com> <CAFewVt6fyqbOZfQkWY=9SM20WcrP0UhfH+3wvXjiYoTjPm2pgA@mail.gmail.com> <CAFewVt5U9awAg4FbdWtXiCATd-kWttdsAwe3eWwcD5SXsKvyWQ@mail.gmail.com> <6F6EDAA8-15F2-4949-B927-4D0BD0E8FFE3@inria.fr> <20151230105207.GB6140@roeckx.be> <20151230111631.GB23341@LK-Perkele-V2.elisa-laajakaista.fi> <CABkgnnV+mzt6tQbM7m2hN5Y=Qk8G1AeYtC=+Xy+e31pdEiq-pQ@mail.gmail.com> <20151231000803.GA23937@LK-Perkele-V2.elisa-laajakaista.fi> <CACsn0c=Wmy9oqnDFuhBY-YUSSYv2Wf-Wf09he+vjwvko=eciFg@mail.gmail.com>
Date: Wed, 30 Dec 2015 14:47:20 -1000
Message-ID: <CAFewVt5GinBy=eE3OmTyZ3UHibuS0NM-TQOyF=Dqaut--WX-Jw@mail.gmail.com>
From: Brian Smith <brian@briansmith.org>
To: Watson Ladd <watsonbladd@gmail.com>
Content-Type: multipart/alternative; boundary="001a113d70324df040052826ff96"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/WrhaIa5GakMrAr6r41lGz0Fv0XM>
Cc: Karthikeyan Bhargavan <karthik.bhargavan@gmail.com>, "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] draft-ietf-tls-curve25519-01: Is public key validation necessary or helpful?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 31 Dec 2015 00:47:22 -0000

Watson Ladd <watsonbladd@gmail.com> wrote:

> Why not hash the public values into the result of the key exchange? I
> don't want security to depend on omittable checks.
>

One would need an omittable check in the code to decide whether to do that
extra hashing, so that wouldn't solve the (non-)problem of "omittable
checks".

Similarly, one would need an omittable check to decide whether to require
the session hash extension, so it wouldn't solve the (non-)problem of
"omittable checks".

Actually, because the check for non-zero result can/should/is in the
X25519/X448 functions themselves, the check for non-zero result is the
least likely of all these possible solutions to be omitted. And, it is also
the easiest to test.

Cheers,
Brian
-- 
https://briansmith.org/

v2.23.0 | Report a Bug | By Email