Re: [Cfrg] RFC 6090 correctness

On Sat, Mar 15, 2014 at 5:44 PM, Paul Hoffman <paul.hoffman@vpnc.org> wrote:
> Please note that RFC 6090 already has a bunch of errata; see <http://www.rfc-editor.org/errata_search.php?rfc=6090>. Maybe Watson and Tanja can coordinate on a concise statement of the current error and turn in a new errata. It would also be grand if people on the list went through the RFC with a finer-tooth comb than they did before it was published and report anything else.
>
> There are enough errata that it feels like the RFC should be updated to deal with them all.

I've submitted an erratum, but there are multiple possible fixes.
Furthermore, the nature of this error is significant: it may be
possible to exploit this mistake in implementations that slavishly
adhere to the RFC. One example of this causing security problems is in
Petersen commitments: ag+bh is usually computed by taking
(a-b)g+b(h+g) and so on recursively. If g and h are crafted so that
h+g results in 2g, not h+g, the commitment doesn't bind to any value
of b. Note that this doesn't require knowing the discrete log of g to
the base h, and in fact is compatible with some "nothing up my sleeve"
means of point generation.

Sincerely,
Watson Ladd
>
> --Paul Hoffman
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin