Re: [TLS] Next steps for draft-agl-tls-padding

[Watson Ladd <[e-mail]>]

On Sun, Apr 6, 2014 at 2:17 PM, Ilari Liusvaara
<[e-mail]> wrote:
> On Sun, Apr 06, 2014 at 10:51:05AM -0700, Watson Ladd wrote:
>>
>> You mean the text on covert channels? I always thought the way to
>> avoid covert channels was to use implementations that didn't have
>> them. In particularly, ECDSA has a covert channel which cannot be
>> closed, and so does OAEP signature.
>
> You mean can't be verifiably closed? Or something else?

All covert channels can be closed by auditing the software. But if I
introduce a leak in the nonce bits of ECDSA that is subtle, or encode
data I want to exfiltrate in the random padding of OAEP, even with the
private key, I cannot detect this.

>
> AFAIK, there is no ECC-based signature primitive that is
> publically deterministic (Ed25519 is no exception to this
> rule).
>
> Of course, ECDSA is rather bad ECC signature scheme as signature
> schemes go...
>
>
> -Ilari

Sincerely,
Watson ladd


-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin