Subject: Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

From: Peter Gutmann <[email-masked]>
Date: Tue, 24 Sep 2013 04:45:31 +0000

Yaron Sheffer <[email-masked]> writes:

>- Does any of this brittleness still apply when talking about ECDH (as
>opposed to ECDSA), with fixed parameters?

Probably not, in terms of brittleness.  But then if you're using fixed ECDH
parameters (rather than, say, regenerating them once an hour and discarding
the old ones) you've got potentially NSA-influenced values like P256 that the
NSA has been awfully keen to get everyone to use, and that even without NSA
skullduggery make a nice single target for attack.  So that's an entirely
different problem.

If you do want to generate your own ECDH parameters (i.e. curves), that's
another huge mess to deal with.  For DH you just use Lim-Lee and you're done
(although the fact that TLS doesn't communicate the 'q' value is something I'd
really like to see corrected), while for ECC you need to get an awful lot of
special-case checks and conditions just right.

Then, once you've done that, you get to find out how many implementations
support the arbitrary_explicit_prime_curves format, which I suspect is pretty
close to zero.

Peter.

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 24 Sep 2013 09:30:30 +0300

Just to clarify my sloppy terminology: I was asking about ECDH with 
named curves (which today means P-256 in practice, but in the future 
will allow non-NIST curves, e.g. Brainpool). Of course the "parameters" 
(DH public key) are generated periodically or even on each connection.

Thanks,
	Yaron

On 09/24/2013 07:45 AM, Peter Gutmann wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Alex Elsayed <[email-masked]>
Date: Tue, 24 Sep 2013 06:37:25 -0700

Peter Gutmann wrote:

<snip>
> another huge mess to deal with.  For DH you just use Lim-Lee and you're
> done (although the fact that TLS doesn't communicate the 'q' value is
> something I'd really like to see corrected), while for ECC you need to get
> an awful lot of special-case checks and conditions just right.

Bernstein and Lange have some interesting stuff regarding that in-progress; 
this presentation[1] points out that those very same special-case checks and 
conditions are made necessary by the types of curves chosen, and that by 
choosing complete, twist-secure Edwards curves those can largely be avoided.

However, neither of the NIST curves nor the Brainpool curves are Edwards 
curves at all due to not having an order 4 point.

> support the arbitrary_explicit_prime_curves format, which I suspect is
> pretty close to zero.

Of course, this remains an issue.

[1] http://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4x3.pdf

---

From: Michael D'Errico <[email-masked]>
Date: Tue, 24 Sep 2013 09:02:30 -0700

Peter Gutmann wrote:
> 
> For DH you just use Lim-Lee and you're done

Can you please provide a pointer to the Lim-Lee algorithm?

Thanks,

Mike