Subject: [COSE] [cose-issues] CFRG document for Curve25519 and Goldilocks has odd shared secret issue (#9)

From: Jim Schaad <[email-masked]>
Date: Sat, 29 Aug 2015 13:43:02 -0700

The current document has the sentence

Alice and Bob can then use a key-derivation function that includes K, K_A and K_B to derive a key.

We need to make a decision if this is necessary or if we can just hash K instead.  The reason given was an attack where either K_A or K_B was set to all zeros by a MITM to force the generated key K to all zeros.  The check of K not being all zeros should protect against this attack without needing to include K_A and K_B in the result.   

Among other things we should track TLS

Note that these curves may not make the cut for the current document.

---
Reply to this email directly or view it on GitHub:
https://github.com/cose-wg/cose-issues/issues/9

---

From: Ilari Liusvaara <[email-masked]>
Date: Sun, 30 Aug 2015 12:23:38 +0300

On Sat, Aug 29, 2015 at 01:43:02PM -0700, Jim Schaad wrote:
> We need to make a decision if this is necessary or if we can just
> hash K instead.  The reason given was an attack where either K_A or
> K_B was set to all zeros by a MITM to force the generated key K to
> all zeros.  The check of K not being all zeros should protect against
> this attack without needing to include K_A and K_B in the result.   

The problem with not hashing K_A or K_B is that attacker can manipulate
the keys so the key derivation results are predictable and can repeat.
Which can lead into trouble (e.g. TLS took a nasty hit from that).

TLS 1.3 draft and TLS 1.2 with appropriate security fix extension
(and there are already drafts that have that extension as REQUIRED)
does hash K_A and K_B into secrets.

Also, SSHv2 does hash K_A and K_B (via handshake hash) into its
secrets.

I don't offhand know if offline protocols (like COSE) got hit in as
nasty manner as online protocols (like TLS).

Also:
- K_A and K_B don't have to be all zeroes to generate "zero" K.
- Some libraries using two-coordinate ECC don't validate points (or
  don't check for existence of square root when uncompressing),
  which effectively creates points with all sorts of strange orders
  or behaviour.
- Some ECC libraries allegedly have strange repesentation of
  infinitity (so attacker can send order-1 point).

-Ilari