Subject: [Cfrg] Curve25519 with ECDH static keys

From: Robert Moskowitz <[email-masked]>
Date: Mon, 25 Jan 2016 16:14:00 -0500

I am trying to determine, what if any considerations there are with 
using Curve25519 in a static ECDH key exchange.

 From Watson Ladd's note back in 8/8/14, it might seem that hashing 
addresses this, but it is unclear what is hashed from his note about a 
comment in a meeting.

My search foo is weak, and I am not coming up with any written item I 
can fall back on.

I see the warning in the security section of RFC 7748 to include the 
public keys in the key generation which is generally described in sec 6.1.

But it is unclear in my reading how to respond to one private 
conversation that there might be concerns on static use (though many 
sensors will use their static key rarely in their active life, the 
sensor controller will use it a bit more frequently, but even it will be 
an infrequent event).

thank you

---

From: Watson Ladd <[email-masked]>
Date: Mon, 25 Jan 2016 13:31:32 -0800

On Jan 25, 2016 1:14 PM, "Robert Moskowitz" <[email-masked]> wrote:
>
> I am trying to determine, what if any considerations there are with using
Curve25519 in a static ECDH key exchange.
>
> My search foo is weak, and I am not coming up with any written item I can
fall back on.
conversation that there might be concerns on static use (though many
sensors will use their static key rarely in their active life, the sensor
controller will use it a bit more frequently, but even it will be an
infrequent event).

The issue is an attack due to Cheon where cases where the DH result is
exposed to an attacker. Using the DH result as a symmetric key only stops
this problem entirely. Relevant terms include strong Diffie-Hellman. This
attack applies to any group.

>
> thank you
>
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg