Subject: Re: [COSE] FW: New Version Notification for draft-selander-ace-cose-ecdhe-00.txt

From: "Jim Schaad" <[email-masked]>
Date: Tue, 5 Apr 2016 15:19:05 -0300

> -----Original Message-----
> From: COSE [mailto:[email-masked]] On Behalf Of Ilari Liusvaara
> Sent: Wednesday, March 23, 2016 3:27 PM
> To: Göran Selander <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [COSE] FW: New Version Notification for draft-selander-ace-cose-
> ecdhe-00.txt
> 
> On Wed, Mar 23, 2016 at 07:32:06AM +0000, Göran Selander wrote:
> > Dear COSE and ACE,
> >
> > We have submitted a draft on ephemeral-ephemeral Diffie-Hellman key
> > exchange embedded in COSE objects.
> >
> > Two versions are presented, one authenticated with pre-shared keys,
> > and one authenticated with static ECDH public keys. The keys used to
> > authenticate the DH-exchange can be obtained as defined in the ACE
> > solution.
> 
> Looks like the ECDH-SS variant is vulernable to KCI (e.g attacker knowing s can
> authenticate as arbitrary client).

Yes, it can authenticate an as an arbitrary client.  But it can only do so to itself under the assumption that the private keys are only owned by the one entity.  I am not sure that this is a real problem that needs to be dealt with.  However, it might be that I am missing something.    With any SS, either party can impersonate the other party to itself.  I don't think this is true for impersonation to a third party

> 
> Also, that g^xs is involved makes it highly important that that invalid-curve
> attacks are properly defended against (point validation or ladders with twist-
> secure curves).

This really does need to get fixed.

Jim

> 
> 
> -Ilari
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose