Subject: [TLS] draft-ietf-tls-rfc4492bis-15 and the X25519 significant bit.

From: David Benjamin <[email-masked]>
Date: Wed, 15 Mar 2017 20:25:34 +0000

draft-ietf-tls-rfc4492bis-15, section 5.11, contains the following text:

   Since there are some implementation of the X25519 function that
   impose this restriction on their input and others that don't,
   implementations of X25519 in TLS SHOULD reject public keys when the
   high-order bit of the final byte is set (in other words, when the
   value of the rightmost byte is greater than 0x7F) in order to prevent
   implementation fingerprinting.  Note that this deviates from RFC 7748
   which suggests that This value be masked.

https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#section-5.11

There was a thread about this way back, but it seems not to have come to a
clear conclusion:
https://www.ietf.org/mail-archive/web/tls/current/msg18821.html

Since then, RFC 7748 has been published and X25519 in TLS has been shipped
by several implementations. From my testing, none of BoringSSL, Cloudflare
servers (tls-tris?), Go, NSS, or OpenSSL implement this check. They all
mask off that bit, as RFC 7748 prescribes. (These were all the
implementations I tested.)

RFC 7748 provides a function on bytes, so, barring strong reasons not to, I
think it is best for TLS to simply reference RFC 7748 as-is. The stated
motivation is preventing implementation fingerprinting, yet all the
implementations listed mask. This paragraph also does not align with the
current TLS 1.3 draft.

Thus, I would suggest the paragraph be removed from the document. It would
then prescribe RFC 7748's behavior which is to mask off that bit. Do others
agree?

David

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 15 Mar 2017 13:29:12 -0700

This seems like compelling logic. The fingerprinting concern doesn't seem
that serious in any case.

-Ekr

On Wed, Mar 15, 2017 at 1:25 PM, David Benjamin <[email-masked]>
wrote:

> RFC 7748 provides a function on bytes, so, barring strong reasons not to,
> I think it is best for TLS to simply reference RFC 7748 as-is. The stated
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: David Benjamin <[email-masked]>
Date: Wed, 15 Mar 2017 20:47:39 +0000

The change was slightly more involved than just striking the paragraph, so
I've put together a PR here. It makes that section much shorter:
https://github.com/tlswg/rfc4492bis/pull/38

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 15 Mar 2017 21:12:37 +0000

> Thus, I would suggest the paragraph be removed from the document. It would then prescribe RFC 7748's behavior which is to mask off that bit. Do others agree?

Yes.

---

From: Brian Smith <[email-masked]>
Date: Wed, 15 Mar 2017 11:32:47 -1000

> https://www.ietf.org/mail-archive/web/tls/current/msg18821.html

Although I argued in favor of a different alternative in that previous
thread, given how RFC 7748 ended up, I agree with your suggested
change, to align with RFC 7748.

Cheers,
Brian
-- 
https://briansmith.org/