Subject: Re: [TLS] Issue #12: RSA/DSA/DH timing attacks

From: Eric Rescorla <[email-masked]>
Date: Sat, 07 Jul 2007 14:42:04 -0700

At Fri, 8 Jun 2007 13:17:26 +0200,
Bodo Moeller wrote:
> On Fri, Jun 08, 2007 at 01:15:52PM +0200, Bodo Moeller wrote:
> 
> > Having said that, here's how you could try to add blinding to DSA
> > exponentiations -- either base and exponent blinding or just exponent
> > blinding:
> > 
> > - Compute  g^k  as  g'^k'  where  g' = g^m  (m random) is a blinded
> >   base value, and where  k' = m'*k mod q.  (Just as with RSA, you
> >   could keep the blinding parameters for a number of cryptographic
> >   operations for better performance.)
> 
> Er,  k' = k/m' mod q,  of course.  (I.e., you need a mod-q inversion.)

OK. I'm not qualified to evaluate this, and I don't think we want to
put it directly in TLS. Is there something we can reference for this
technique or are you OK with leaving this as-is?

-Ekr

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Tue, 10 Jul 2007 15:19:23 +0200

> technique or are you OK with leaving this as-is?

I think just including a general recommendation to do something about
timing attacks is appropriate for the TLS specification.  This could
go into the Security Considerations section.

There's a "MUST" for RSA in the current draft ("MUST use RSA blinding
or some other anti-timing technique"), but this appears just in the
section on RSA-encrypted premaster secrets, which actually is a
situation quite different from that for DSA.  With an encrypted
premaster secret, an adversary gets to pick the input to the RSA
exponentiation; for signatures, the adversary can't get that much
control.  DSA is similar in use to RSA *signatures*, for which the
current draft does not demand blinding.

The Security Considerations should mention timing-attack issues for
all kinds of public-key cryptography, but they shouldn't provide
detailed recommendations on how to handle these, since this is still a
research topic.

Bodo