Subject: Re: [Cfrg] Two questions on Curve25519 and HMQV

From: "Paterson, Kenny" <[email-masked]>
Date: Thu, 14 Jul 2016 11:11:34 +0000

Hi Jim,

As far as I can see, there was no reply to your e-mail. Let me try, then.

On 01/07/2016 04:57, "Cfrg on behalf of Jim Schaad" <[email-masked]
on behalf of [email-masked]> wrote:

>In the process of getting an analysis of what the implications of the PKIX
>encoding for the Curve25519 and Curve448 curves are the following
>questions
>have arisen:
>
>1.  Are there any known implications of using the same key pair for both
>ECDH and ECDH-HMQV?  I know that there are some security considerations in
>terms of using ECDH-MQV.

I'm guessing this is not what you want to hear, but please just don't do
it! Different keys for different purposes. Otherwise we have to do a
potentially complicated security analysis that looks at all the possible
unexpected nastiness that might arise from interactions between different
protocols using the same key pairs in different ways. And in the end, we
might find an attack instead of a proof...

As you'll know, there are past examples of this kind of key reuse going
badly wrong in the RSA setting - e.g. A Bleichenbacher-style attack on an
RSA key used for encryption with PKCS#1v1.5 can then be used to forge a
signature that's valid when the same key is used for signature
verification. A specific illustrative example of this is the recent
cross-protocol attack on different versions of TLS:
https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/08/21/Tls13QuicAt
tacks.pdf

I know that's not quite the same as your setting of key exchange, but it's
not a million miles away...

>
>2.  Are there any known issues for using the 25519 and 448 curves with
>HMQV
>that would need to be called out?  From my simplistic view of the world, I
>don't see anything that is a problem bug I cannot be sure.

I don't think so, modulo all the usual implementation pitfalls, the need
to carefully handle co-factors, group membership testing, etc, etc. This
is because both curves provide suitable platform groups in which the
relevant DH problems can reasonably be assumed to be hard.

Cheers

Kenny 

>
>Jim
> 
>
>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www.irtf.org/mailman/listinfo/cfrg