[TLS] Curve25519 and TLS

[Watson Ladd <[e-mail]>]

Dear all,

TLS with ECC computes the premaster secret as H(abg) where g is the
generator of the group, and a and b are the ephemeral exponents.
Because of protocol weaknesses, this premaster secret must be
"contributory": neither side can be allowed to dictate it.

Curve25519 has order 8*q, where q is some prime. All encoded public
keys lie on this or a twist with order 4*q'. (I might be wrong in the
details, but it's right enough). In particular there is a point of
order 2.

A malicious server can provide a point of order 2, and with 50%
probability get a dictated premaster secret.

The solution is to follow the advice on contributory behaviour and
disallow a fixed list of public keys, namely those of small order.
Alternatively we can compute the premaster secret as the hash of H(ag
| bg | abg): I have not yet confirmed that this solves the problem.

For TLS 1.3 we should ensure contributory behaviour is not required to
avoid these issues.

Sincerely,
Watson Ladd