Subject: [TLS] I-D Action: draft-ietf-tls-rfc4492bis-05.txt

From: [email-masked]
Date: Tue, 03 Nov 2015 19:05:11 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Transport Layer Security Working Group of the IETF.

        Title           : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier
        Authors         : Yoav Nir
                          Simon Josefsson
                          Manuel Pegourie-Gonnard
	Filename        : draft-ietf-tls-rfc4492bis-05.txt
	Pages           : 31
	Date            : 2015-11-03

Abstract:
   This document describes key exchange algorithms based on Elliptic
   Curve Cryptography (ECC) for the Transport Layer Security (TLS)
   protocol.  In particular, it specifies the use of Ephemeral Elliptic
   Curve Diffie-Hellman (ECDHE) key agreement in a TLS handshake and the
   use of Elliptic Curve Digital Signature Algorithm (ECDSA) and Edwards
   Digital Signature Algorithm (EdDSA) as new authentication mechanisms.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-05

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-rfc4492bis-05

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Yoav Nir <[email-masked]>
Date: Wed, 4 Nov 2015 12:56:10 +0900

This includes three of the pull requests we discussed at the meeting.

I’ve left the change in IANA registry policies out for now because we’re not yet in agreement about how that should go.

Yoav

> On 4 Nov 2015, at 12:05 PM, [email-masked] wrote:
> 
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Watson Ladd <[email-masked]>
Date: Wed, 4 Nov 2015 06:30:26 -0500

This draft continues to have security issues when used in TLS 1.2. An
attacker can mount triple-handshake by using points of small order on
Curve25519, generating zero on both sides. This draft needs to say
that Curve25519 can only be used along with extended master secret.
Alternatively we can completely remove the cofactor and reject zero
keys.

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 4 Nov 2015 13:34:48 +0200

On Wed, Nov 04, 2015 at 06:30:26AM -0500, Watson Ladd wrote:
> This draft needs to say that Curve25519 can only be used along with
> extended master secret. Alternatively we can completely remove the
> cofactor and reject zero keys.

X25519 and X448 specifications say zero keys MUST be rejected (and
the functions are also internally specified to clear the cofactor).

-Ilari

---

From: Watson Ladd <[email-masked]>
Date: Wed, 4 Nov 2015 06:56:15 -0500

> the functions are also internally specified to clear the cofactor).

The language used in the current draft doesn't clearly say you must
use the definition in CFRG curves which does this with cofactor
business, and in fact doesn't include the string X25519.

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 4 Nov 2015 14:29:58 +0200

> business, and in fact doesn't include the string X25519.

I made PR #16 about this (renamed the functions and added the zero
checks).

-Ilari

---

From: Hubert Kario <[email-masked]>
Date: Wed, 04 Nov 2015 13:45 +0100

> https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-05

typo:
MUST still be included, and contain exactly one value: the uncomptessed 
point format (0).

is "uncomptessed" should be "uncompressed"
		 	
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: Yoav Nir <[email-masked]>
Date: Thu, 5 Nov 2015 00:21:17 +0900

Thanks!  Fixed in master.

> On 4 Nov 2015, at 9:45 PM, Hubert Kario <[email-masked]> wrote:
> 
> Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic_______________________________________________
> TLS mailing list
> [email-masked]

---

From: Yoav Nir <[email-masked]>
Date: Thu, 5 Nov 2015 00:23:35 +0900

> On 4 Nov 2015, at 9:29 PM, Ilari Liusvaara <[email-masked]> wrote:
> 

Link to the PR:
https://github.com/tlswg/rfc4492bis/pull/16/files

Are we all OK with renaming Curve25519 to X25519 (and same for Curve448) ?

Yoav