Subject: [Uta] draft-sheffer-tls-bcp: ECDHE checks

From: Johannes Merkle <[email-masked]>
Date: Fri, 25 Apr 2014 11:57:15 +0200

Another suggestion for draft-sheffer-tls-bcp

When re-using keys for ECDHE (which is the default behavior in some implementations, e.g. OpenSSL) or when using
non-ephemeral ECDH, the validity of the received public DH-key should be checked to avoid non-group attacks (if the
curve is not twist secure). That is, it should be checked that the received point P is on the curve (unless point
compression was used).

In addition, in case of classical DHE / DH, unless Sophie-Germain primes are used, it could make sense to check for
small subgroups.
-- 
Johannes

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Fri, 25 Apr 2014 13:57:08 +0200

On 25/04/2014 11:57, Johannes Merkle wrote:
> When re-using keys for ECDHE (which is the default behavior in some
> implementations, e.g. OpenSSL) or when using non-ephemeral ECDH, the validity
> of the received public DH-key should be checked to avoid non-group attacks
> (if the curve is not twist secure).

I disagree with the parenthesis. Unless I'm seriously mistaken, as long as both
x and y coordinates are transmitted, implementations have to check if the point
lies on the curve even if the curve is twist secure.

Manuel.

---

From: Johannes Merkle <[email-masked]>
Date: Fri, 25 Apr 2014 16:05:14 +0200

> lies on the curve even if the curve is twist secure.

you are right, I was mistaken. As long as the curve is twist secure AND sngle co-ordinate formulas (ladders) are used,
you need to check the validity in order to prevent serious key leakage.

-- 
Johannes