[Cfrg] Switching the zero-check from MUST to MAY in the curves draft.

Adam Langley <agl@imperialviolet.org> Mon, 16 November 2015 23:03 UTC

MIME-Version: 1.0
Sender: alangley@gmail.com
Date: Mon, 16 Nov 2015 15:03:01 -0800
Message-ID: <CAMfhd9XgxrFyRxEqd=4NSX29t=ymQeyq3pT6VjpezUgrm6TyBg@mail.gmail.com>
From: Adam Langley <agl@imperialviolet.org>
To: "cfrg@irtf.org" <cfrg@irtf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/khKjcRgkgHGMtyXUWmQJ62Be-nE>
Subject: [Cfrg] Switching the zero-check from MUST to MAY in the curves draft.
Precedence: list

At the moment, the curves draft says that implementations MUST check
for the all-zero output and abort if it's found, at least in
Diffie-Hellman. The all-zero output results when the input point has
small order and this sort of thing has, in the past, broken at least
Tor and TLS channel bindings.

While reactions on the list were ambivalent to the suggestion, I had
hoped that implementations would take this requirement as a simple
defence-in-depth measure in keeping with the general robustness theme
of this work.

I was mistaken. It's since become clear that some disagree
sufficiently strongly about this that we aren't going to see a
realignment of implementations around this behaviour. While I still
think that it's a sensible requirement, RFCs that are prescriptive
rather than descriptive are terrible and so I currently hope to switch
from MUST to MAY once the draft has completed the editor's queue.
Instead, some wording would be added to the Security Considerations
section.

This change contains the accumulation of tweaks that I currently have
saved up, including this one:
https://github.com/agl/cfrgcurve/commit/c7749d4bb5ceabdb30f211d4aaa6df2b68d7c5e1

This email is notice that I currently plan on making this change. Note
that the question here isn't whether the zero check is a good idea or
not. Rather it's that, given that a non-trivial number of
implementations aren't going to implement it, what's the best thing to
write?


Cheers

AGL

-- 
Adam Langley agl@imperialviolet.org https://www.imperialviolet.org

[Cfrg] Switching the zero-check from MUST to MAY … Adam Langley
Re: [Cfrg] Switching the zero-check from MUST to … Blumenthal, Uri - 0553 - MITLL
Re: [Cfrg] Switching the zero-check from MUST to … Deirdre Connolly
Re: [Cfrg] Switching the zero-check from MUST to … Phillip Hallam-Baker
Re: [Cfrg] Switching the zero-check from MUST to … Mike Hamburg
Re: [Cfrg] Switching the zero-check from MUST to … Taylor R Campbell
Re: [Cfrg] Switching the zero-check from MUST to … Watson Ladd
Re: [Cfrg] Switching the zero-check from MUST to … Phillip Hallam-Baker
Re: [Cfrg] Switching the zero-check from MUST to … Adam Langley
Re: [Cfrg] Switching the zero-check from MUST to … Deirdre Connolly
Re: [Cfrg] Switching the zero-check from MUST to … Rene Struik
Re: [Cfrg] Switching the zero-check from MUST to … Rene Struik
Re: [Cfrg] Switching the zero-check from MUST to … Greg Hudson
Re: [Cfrg] Switching the zero-check from MUST to … Watson Ladd
Re: [Cfrg] Switching the zero-check from MUST to … Rene Struik
Re: [Cfrg] Switching the zero-check from MUST to … Watson Ladd