Subject: [Cfrg] ECDH subgroup attack question

From: Robert Moskowitz <[email-masked]>
Date: Tue, 28 Jan 2020 16:46:08 -0500

In TLS 1.3, RFC 8446 sec 4.2.8.1 the testing range for Y is:

1 < Y < p-1

In RFC 2785 sec 3.1, that references 2631, the range for Y is:

"within the interval [2, p-1]"

TLS 1.3 is more liberal, it seems to me, than 2785.

What is 'right' / 'safe'.

Further 2785 has a second check:

Compute y^q mod p. If the result == 1, the key is valid.

Is this test still advised?

thank you

---

From: Andrey Jivsov <[email-masked]>
Date: Tue, 28 Jan 2020 14:18:49 -0800

RFC 2785 sec 3.1 should be read as consisting of two steps that you noted.
When Y = p-1, Y^q = p-1, where q is a large (odd) prime, and thus this
highest allowed value of Y in step 1 will be rejected in step 2.

Therefore, the range check portion is equivalent to TLS 1.3 range check. We
want to reject values Y= {1, -1 = p-1} as invalid public keys. These values
are elements of the small subgroup.

On Tue, Jan 28, 2020 at 1:46 PM Robert Moskowitz <[email-masked]>
wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Richard Barnes <[email-masked]>
Date: Tue, 28 Jan 2020 17:20:12 -0500

> TLS 1.3 is more liberal, it seems to me, than 2785.

No, TLS 1.3 is more conservative, since it rules out p-1 (i.e., it allows
[2, p-2]).  This is more safe because p-1 generates the subgroup of order
two {p-1, 1}.

--Richard

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 28 Jan 2020 17:43:08 -0500

Is there some external document to reference when providing this text in 
a draft's Security Considerations section?

Or is this 'so well known' now that putting it in the Security 
Considerations is all that is needed.

thanks

On 1/28/20 5:20 PM, Richard Barnes wrote:
>
>
> On Tue, Jan 28, 2020 at 4:46 PM Robert Moskowitz 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
> No, TLS 1.3 is more conservative, since it rules out p-1 (i.e., it 
> allows [2, p-2]).  This is more safe because p-1 generates the 
> subgroup of order two {p-1, 1}.
>
> --Richard
>
>
>     [email-masked] <mailto:[email-masked]>

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 28 Jan 2020 23:11:40 +0000

Just a nitpick, just saw the thread, this is a DH subgroup attack question, not an ECDH subgroup attack question.

Peter.?

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 28 Jan 2020 18:29:09 -0500

On 1/28/20 6:11 PM, Peter Gutmann wrote:
>
> Just a nitpick, just saw the thread, this is a DH subgroup attack 
> question, not an ECDH subgroup attack question.
>

Oh?  Thank you for nit picking.

So if the keys used in the DH exchange are ony NIST p256 and p384 this 
test is not needed?

This issue was brought to my attention in a security review on use of 
p256 keys in exchange.   I just ran without digging into what I needed 
to add without catching what KIND of DH exchange it applies to....

Now I have to read the comment again and figure this all out.

Fun.  By some definition of fun.

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 28 Jan 2020 18:34:55 -0500

> Fun.  By some definition of fun.

Ah, I jumped to the wrong section of TLS 1.3.  Not 4.2.8.1, but 4.2.8.2.

My bad.

Which points to sec 4.3.7.

More reading!  Hopefully no more questions for here.

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 28 Jan 2020 18:38:09 -0500

On 1/28/20 6:34 PM, Robert Moskowitz wrote:
>> So if the keys used in the DH exchange are ony NIST p256 and p384 
>> this test is not needed?
>>
>> p256 keys in exchange.   I just ran without digging into what I 
>> needed to add without catching what KIND of DH exchange it applies to....
>>

Sec 4.3.7 of ANSI X9.62-2005 which I don't have.  But the text in TLS 
looks clear enough to use.