Subject: Re: [Cfrg] ECC reboot (Was: When's the decision?)

From: "Hallof, Andreas" <[email-masked]>
Date: Fri, 17 Oct 2014 15:24:37 +0000

Please add to these 50+ million smartcards, another 70 million german eHealth-Cards. 
Every statutory health insurance patient in Germany has a smartcards, that is capable of 
supporting a client-authenticated TLS-Session (RSA-based keys + dedicated TLS-Certificate).
In medium term we want to migrate to an ECC-based scheme.

> Besides, those smartcards are surely already provisioned and keyed so not relevant to any new curve?
Wrong.

If independent from each other three different Chipcard-Manufacturer tell me they prefer using 
curves with random primes then this tells me something.

Regards,
 Andreas Hallof 

--
Andreas Hallof, Datenschutz und Datensicherheit / Kryptographie

-----Ursprüngliche Nachricht-----
Von: Cfrg [mailto:[email-masked]] Im Auftrag von Alyssa Rowan
Gesendet: Freitag, 17. Oktober 2014 11:40
An: [email-masked]
Betreff: Re: [Cfrg] ECC reboot (Was: When's the decision?) [NICHT VERSCHLUESSELT, ] [SIGNATUR_UNPRUEFBAR, OpenPGP]

On 17 October 2014 10:21:43 BST, Johannes Merkle <[email-masked]> wrote:

>> from the hesitant adoption of Brainpool in the wider community,
>this assertion is only true for software implementations. Brainpool curves are used by more than 50 million smartcards rolled out and several vpn solutions (e.g., based on IPSec) widely used within German and EU public authorities.

Yes, that's exactly my point. Brainpool usage seems to be concentrated under a relatively small, interlocked group of governmental stakeholders in specialist applications - not really rolled out in the wider community like the NIST curves, let alone like RSA.

Besides, those smartcards are surely already provisioned and keyed so not relevant to any new curve?

--
/akr

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Fri, 17 Oct 2014 17:51:14 +0200

On 17/10/2014 17:24, Hallof, Andreas wrote:
> If independent from each other three different Chipcard-Manufacturer tell me
> they prefer using curves with random primes then this tells me something.
> 
I don't disagree with that, but unless I missed something nobody answered the
following question yet: why can't people who prefer random primes use the
already published and standardised (for use with PKIX and TLS and probably
others) Brainpool curves?

If the people who need/prefer random primes are happy with the current Brainpool
curves, then the new curves only need to satisfy the rest of the world.
(Assuming the CFRG decision clearly state that they are not intended as a
replacement to the Brainpool curves, but as a complement.)

Manuel.

---

From: David Leon Gil <[email-masked]>
Date: Fri, 17 Oct 2014 15:19:06 -0400

On Fri, Oct 17, 2014 at 11:24 AM, Hallof, Andreas
<[email-masked]> wrote:
> If independent from each other three different Chipcard-Manufacturer tell me they prefer using curves with random primes then this tells me something.

It tells you that, like most semiconductor companies, they are
cheapskates. They would rather you continue to use their (existing)
inadequately protected solutions, so that they can save on design
costs.

If they can cite published work that shows that a higher level of
assurance can be achieved, given a correctly implemented masking
scheme, by using a random prime, they are free to share one.

(The previous citation from the manufacturers, AFAIK, shows an attack
on the sort of blinding scheme Joye and others have demonstrated is
inadequate -- and which does not even pass a basic smell test.)

---

From: Alyssa Rowan <[email-masked]>
Date: Fri, 17 Oct 2014 22:07:20 +0100

On 17/10/2014 16:24, Hallof, Andreas wrote:

> (RSA-based keys + dedicated TLS-Certificate).

Irrelevant. You're citing deployment (of RSA?) in (another) very limited
field of specific governmental stakeholders.

Brainpool is quite rarely deployed in IETF protocols worldwide,
despite it being standardised for some time now and being available in
some
libraries: a fact that anyone with zmap and Python can easily verify.

Consider: If Brainpool-style curves addressed the TLS WG's needs, they
wouldn't be asking us for new curves, they'd be using the Brainpool
curves they've already got, wouldn't they?

The _very_ poor software performance of random primes is the reason why.
No mystery there.

> In medium term we want to migrate to an ECC-based scheme.

And you're free to choose any you want to.

Brainpool isn't magically going away for those that want it, you know. I
am not expecting the NIST curves will vanish overnight either!

> If independent from each other three different
> Chipcard-Manufacturer tell me they prefer using curves with random
> primes then this tells me something.

It tells me something, too - those three are being cheap as hell.

They are reusing an old rusty RSA multiplier whose blinding falls short
over sparse prime fields, and they're not really willing to redesign or
recertify their decade-plus-old designs to improve that, even in the
face of improved attacks and 'high assurance' hardware they're shipping
tens of millions of units of.

There are more than 3 smartcard vendors, and some others have
supported the NIST curves (which are special primes) just fine.

So no, I don't find that argument compelling, or highly assuring.

- -- 
/akr