From: Stefan Berger <stefanb@linux.ibm.com>
To: Nym Seddon <unseddd@protonmail.com>,
Stefan Berger <stefanb@linux.vnet.ibm.com>
Cc: "dhowells@redhat.com" <dhowells@redhat.com>,
"keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"herbert@gondor.apana.org.au" <herbert@gondor.apana.org.au>,
"davem@davemloft.net" <davem@davemloft.net>,
"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
"patrick@puiterwijk.org" <patrick@puiterwijk.org>
Subject: Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys
Date: Wed, 27 Jan 2021 17:42:20 -0500 [thread overview]
Message-ID: <fa061535-4870-215f-aacb-710cc086e8a9@linux.ibm.com> (raw)
In-Reply-To: <yOgLSllWWtGlr6OYcQxe8CeFwK4H9cWzWbalszgSv4xN_DxK6AGG_vNRyuVX6aKHzesDaj0LK9pB0q8SIQWXQETX26J6KXe428OPMHJYvus=@protonmail.com>
On 1/27/21 11:12 AM, Nym Seddon wrote:
> Hi Stefan,
>
> In the recommendations from SafeCurves (https://safecurves.cr.yp.to/twist.html) there are a number of attacks against ECC twists. Two of those attacks are relevant against NIST P192: invalid-curve attacks and invalid-curve attacks against ladders.
>
> Both attacks can be mitigated by checking the supplied public key is on the correct curve, before performing curve operations.
>
> Not sure if the right place for those checks are in the signature verification code provided in these patches, or when reading public keys from the certificates. Does the kernel provide functions for checking curve points satisfy their respective curve equations?
>
> There are also tables describing the cost of combined attacks on various curves, where NIST P224 already falls below the safe threshold. Because of that, I would recommend not implementing support for NIST P192 (since it would fair even worse).
>
> What are your thoughts?
I am calling into a function performing such a test at the end of the
function parsing the public key:
return ecc_is_pubkey_valid_full(ctx->curve, ctx->pub_key)
https://elixir.bootlin.com/linux/latest/source/crypto/ecc.c#L1458
Is that good 'enough' ?
Stefan
prev parent reply other threads:[~2021-01-27 23:21 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-27 12:33 [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys Stefan Berger
2021-01-27 12:33 ` [PATCH v3 1/3] x509: Detect sm2 keys by their parameters OID Stefan Berger
2021-01-30 21:26 ` Jarkko Sakkinen
2021-01-31 2:57 ` Stefan Berger
2021-02-02 15:16 ` Jarkko Sakkinen
2021-01-27 12:33 ` [PATCH v3 2/3] x509: Add support for parsing x509 certs with NIST p256 keys Stefan Berger
2021-01-27 19:31 ` Herbert Xu
2021-01-27 22:39 ` Stefan Berger
2021-01-27 12:33 ` [PATCH v3 3/3] x509: Add support for NIST p192 keys in certificates and akcipher Stefan Berger
2021-01-27 13:05 ` [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys David Howells
2021-01-27 14:22 ` David Howells
2021-01-27 19:32 ` Herbert Xu
2021-01-27 21:08 ` David Howells
2021-01-27 16:12 ` Nym Seddon
2021-01-27 22:42 ` Stefan Berger [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fa061535-4870-215f-aacb-710cc086e8a9@linux.ibm.com \
--to=stefanb@linux.ibm.com \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=herbert@gondor.apana.org.au \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=patrick@puiterwijk.org \
--cc=stefanb@linux.vnet.ibm.com \
--cc=unseddd@protonmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).