Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

On 07/04/2014 08:15 AM, Watson Ladd wrote:
> On Fri, Jul 4, 2014 at 7:59 AM, Johannes Merkle
> <johannes.merkle@secunet.com> wrote:
>> Alyssa Rowan wrote on 27.06.2014 08:46:
>>> Brainpool has already generated a set of 'random' primes, but random primes are extremely slow to implement - and
>>> in the case of Brainpool, the 256-bit curve has extremely unfortunate lack of twist security, so any implementation
>>> that tries to skip validation is in really big trouble.
>> Why should anyone try to skip validation? In order to improve performance by less than 1%?
> Implementations frequently expose an API where validation is separate
> from group operations, and people
> just forget to make the call sometimes.

However, point validation, or validation of an element in a DH group 
(http://tools.ietf.org/html/rfc6989#section-2.2) is a common requirement 
for a crypto implementation. FIPS 140-2 crypto module algorithm 
validation includes point validation testing 
(http://csrc.nist.gov/groups/STM/cavp/documents/dss2/ecdsa2vs.pdf 
requires tests from Section A.4.2 of ANSI X9.62)

An implementation that doesn't do required EC point checks may have 
other flaws at higher levels. Replacing a low-level crypto primitive 
with a stronger one does not necessarily make the entire stack secure. 
Some may argue that this obscures the results of a security audit.

In reality all we are talking about is plugging (x,y) in the curve 
equation and checking that the two sides match. As was pointed out, when 
compression is used, this check is "forced".

> Furthermore, with anything other than a compressed format it's not
> just twist security, but any security that failure of point validation
> harms.
> I send point on a curve with smooth order, and extract the key. I send
> point on curve with small order, and dictate the key, etc.

It would be good to list what does twist security mean for TLS. 
http://safecurves.cr.yp.to/twist.html references the paper that uses an 
ElGamal decryption oracle. The attack will reveal the decryption scalar.

How does this translate to TLS? I assume we are talking about ECDH only.

Regarding dictating the key, it seems that a (corrupt) peer can always 
limit his private key to a small value and thus dictate the shared 
secret to be close to another peer's public key.

>
> Twist security matters for Joyce-Briers ladders only, as far as I know
> on Weierstrass curves. Other formulas use the y coordinates.

>
> Sincerely,
> Watson Ladd
>>
>> --
>> Johannes
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>
>