Subject: Re: [Uta] WGLC for draft-ietf-uta-rfc7525bis-04

From: Thomas Fossati <[email-masked]>
Date: Mon, 24 Jan 2022 09:43:06 +0000

Hi Ilari, thanks for the great feedback.

On the exponents reuse point you raised:

From: Uta <[email-masked]> on behalf of Ilari Liusvaara <[email-masked]>
> - Section 6.4:
>
> Reusing ECDH exponents is insecure unless one either:
>
> 1) Checks for point validity, or
> 2) Uses montgomery ladder with twist-secure curve.
>
> Currently the only curves in TLS satsifying 2) are x25519 and x448.
> For any other elliptic curve, reusing exponents without validating
> points is insecure. Few thoursand connection attempts at most is
> sufficient for recovering the ECDH private key, which compromises any
> connection that used it.

Please see https://github.com/yaronf/I-D/pull/291

cheers!
--

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Thomas Fossati <[email-masked]>
Date: Wed, 26 Jan 2022 16:14:03 +0000

From: UTA <[email-masked]> on behalf of Thomas Fossati <[email-masked]>
> > sufficient for recovering the ECDH private key, which compromises
> > any connection that used it.
>
One thing that might not be evident from the linked PR is that as part
of addressing Ilari’s WGLC review we are now recommending X25519
alongside P-256 for TLS 1.2.

cheers,
--