IETF Logo Mail Archive

[TLS] Negotiated Finite Field Diffie-Hellman shared secret calculation

Andrey Jivsov <crypto@brainhub.org> Wed, 20 February 2019 00:10 UTC

Return-Path: <crypto@brainhub.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1AD2130FD0 for <tls@ietfa.amsl.com>; Tue, 19 Feb 2019 16:10:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcastmailservice.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q392ap1kxdVq for <tls@ietfa.amsl.com>; Tue, 19 Feb 2019 16:10:27 -0800 (PST)
Received: from resqmta-po-04v.sys.comcast.net (resqmta-po-04v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:163]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66654128B33 for <tls@ietf.org>; Tue, 19 Feb 2019 16:10:27 -0800 (PST)
Received: from resomta-po-19v.sys.comcast.net ([96.114.154.243]) by resqmta-po-04v.sys.comcast.net with ESMTP id wBTSgtEztzQkcwFT0g9nuh; Wed, 20 Feb 2019 00:10:26 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastmailservice.net; s=20180828_2048; t=1550621426; bh=68vF+6h2XUOQ6mmPYfsBaaNOLS9T9hdgy6BLUSR1BQA=; h=Received:Received:To:From:Subject:Message-ID:Date:MIME-Version: Content-Type; b=gucbm/yVE3kdNL4y1Xx/9PQKP+zKVMeRQtGAMz+BTQhLmdVEWyS432P4sb/2idt8u QN9E3qHaGNJtBjlEdvg7PJrf7Pf4v1SBk9u2KWpGeNc4Ax024DDjg8ZU/rR0lp9nqx M57A0WFruZiwf9M9+etSxecb9zIcH2C4G6zD+2djqE3F3mboNapuB2J/bccZV0dneL 9pwIjw6LABMb7md+Wo7d2midSxdRdGvbbRcPVeFEOmllXxXdX9vKHM9iMCxEYjVa0c 5U3DmtRrVBQm++myHzYLuPeXEV/+x5yJeAqCpnjoYRBp+qtIjN2eQhktKJBSTYbfzk 9bxr9hSZj/4Tg==
Received: from [IPv6:::1] ([73.222.32.57]) by resomta-po-19v.sys.comcast.net with ESMTPSA id wFSygFKXXzVxawFSzg6AxY; Wed, 20 Feb 2019 00:10:26 +0000
X-Xfinity-VAAS: gggruggvucftvghtrhhoucdtuddrgedutddrtdehgddulecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucevohhmtggrshhtqdftvghsihdpqfgfvfdppffquffrtefokffrnecuuegrihhlohhuthemuceftddtnecunecujfgurhepvffhuffkffgfgggtgfesthekredttdefjeenucfhrhhomheptehnughrvgihucflihhvshhovhcuoegtrhihphhtohessghrrghinhhhuhgsrdhorhhgqeenucffohhmrghinhepihgvthhfrdhorhhgnecukfhppeejfedrvddvvddrfedvrdehjeenucfrrghrrghmpehhvghloheplgfkrfhvieemmeemudgnpdhinhgvthepjeefrddvvddvrdefvddrheejpdhmrghilhhfrhhomheptghrhihpthhosegsrhgrihhnhhhusgdrohhrghdprhgtphhtthhopehtlhhssehivghtfhdrohhrghenucevlhhushhtvghrufhiiigvpedt
X-Xfinity-VMeta: sc=??;st=legit
To: "tls@ietf.org" <tls@ietf.org>
From: Andrey Jivsov <crypto@brainhub.org>
Openpgp: preference=signencrypt
Autocrypt: addr=crypto@brainhub.org; prefer-encrypt=mutual; keydata= mQENBFbFIDkBCAC8U4isfYajmIZOZW/aX9IuLhfGiAkteTTTEUyjSwyC4MvJl+wfWLeoY4FG F5kyQNmVRidkXIq9R1YA6fWXTGMZLGRZ9u3TaBhngdkck9g8x+uloRV7FROQ5Qu8CrlmURB+ Sp1yK3thaKayFmGfglCFuygeCCHfrHkdjOM64bi93NC2vANOUtwZ8bwbCk3RP/twG9yjzevc ZXoYvnzbib0ct9lgOVO+na28F+LvAsLjxQjSEN6Z+BiuF8Uniq27uKeDPWu6/gvVkl3iZJJA 7SFvr8r/AHEl2EoDGzRT/zL/VtRM1neU2G3RpS6Vm1EDez3rRAPmFmDHcLkXoKKYuJ/dABEB AAG0I0FuZHJleSBKaXZzb3YgPGNyeXB0b0BicmFpbmh1Yi5vcmc+iQE4BBMBAgAiBQJWxSA5 AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRC4BFp9tvLDS4AUCAC6c6zQsm9/gGDW IQy67jMCzKLci9R1GJS5r13vgUHCWdZeZivd0iMuYR/feAV52eqUPWKUZAr6J61QXKfoxyr2 5nK8pk/LJU3nWCPfVsxEHXUnYPYHKpHzlEgbrtyOh/M5eIWGskZDxRBbyxJHV1+Ci5kG/o0s t+DKM4zWOwD+RcO2ktjjXKE/YjAqfoped3JKpzAKyz2OKXsR6QZy0f+lJmRsEU7B6vPBQBnH TRg+4DwkM8MZTKbbygrKPjfaZ0TOBHNzEvjOcyH9OC0jPu0cUOfNoU2ksBPC6aqoSTTFTpV+ 4zAPQtPtUgEir5I73rG8wdAnF828t/GBwraVbQ94uQENBFbFIDkBCADlZHIVKgQsTVQJu6p/ K0iGQA+YpaMaGqp3+BCrScW2rsgauF8ZLJE5tYM6a42bJ1kIq7+PtXm4tq4E7YOcMoVdln6x eta+3La4yKZn3tn6it8YYVK63rG1zQL9epnNPFEfmWH5QWgsLpo2EwQ+Eaue3EvpC9QKImbW vtCHcpZToyYiFLmKusi/njVRUPkr99TCFdMnVrJI7EjPR6vycrlJnIz0ovoOsUm0j9ZRSdax ikUKd1F/h+RMSXpCzx8y6RjR8B8v3zrX9lScygmn1nww54IJtz2ocTIDfLRaqSdViYi/U/sU EYQQoW2Fx5wr9HZo88kJVTB+2sD6ly0ZqfAjABEBAAGJAR8EGAECAAkFAlbFIDkCGwwACgkQ uARafbbyw0vcxwf8DGQVz0FU4/ZJk7PPsHnBtR0oL9PMLfPByQGDTpYFkXMoBh75Yp8EQp6J /ZMRBTwCpbt+amJeahR3IJSWUWomVcHzoVZql4PkphSipp4a6xR0Ah6qtpltviv3ZaAEysvI /JvUc/8wiw9sQwG9GyCQxeH+4npspgXQ2hYjaJOfl4F4P0FzZ3c9xTv0tiBfrdqBzNXu4QY/ jRHxEZzUxPYBvCpEBj1b8j2ZlYEsLEO3Rp8br3WpOhGlhuDOkW3MKtL7tpc749SN8WqiR4Yc JrBwKKi/bfAf4OkMF6+4ZB2fsxyrRWmNc6d2io4+sWsnyFF2NfVbwB6Hcwj46vEmu0SYvA==
Message-ID: <6fff39d3-649d-867a-db71-b0faa18185a5@brainhub.org>
Date: Tue, 19 Feb 2019 16:10:24 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/klYHVOipPt7kXvsbv4u9Lk_jPKU>
Subject: [TLS] Negotiated Finite Field Diffie-Hellman shared secret calculation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Feb 2019 00:10:30 -0000

Greetings.

it's unclear to me how is the shared secret g^xy calculated for groups
in https://tools.ietf.org/html/rfc7919 .

If you recall, the TLS 1.1 uses this method the
https://tools.ietf.org/html/rfc4346#section-8.1.2 , causing some
interoperability problems that are hard to fix.

The RFC 7919 doesn't specify what to do here.

So, the question is, assuming that ffdhe2048 is negotiated,

- is g^xy padded to 256 bytes (more sound method) or
- the leading zero bytes of g^xy must be stripped (legacy method, used
for historic reasons)?

Thank you.

v2.23.0 | Report a Bug | By Email