linux-kernel - Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192 keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 27 Jan 2021 17:42:20 -0500
From:   Stefan Berger <stefanb@...ux.ibm.com>
To:     Nym Seddon <unseddd@...tonmail.com>,
        Stefan Berger <stefanb@...ux.vnet.ibm.com>
Cc:     "dhowells@...hat.com" <dhowells@...hat.com>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        "patrick@...terwijk.org" <patrick@...terwijk.org>
Subject: Re: [PATCH v3 0/3] Add support for x509 certs with NIST p256 and p192
 keys

On 1/27/21 11:12 AM, Nym Seddon wrote:
> Hi Stefan,
>
> In the recommendations from SafeCurves (https://safecurves.cr.yp.to/twist.html) there are a number of attacks against ECC twists. Two of those attacks are relevant against NIST P192: invalid-curve attacks and invalid-curve attacks against ladders.
>
> Both attacks can be mitigated by checking the supplied public key is on the correct curve, before performing curve operations.
>
> Not sure if the right place for those checks are in the signature verification code provided in these patches, or when reading public keys from the certificates. Does the kernel provide functions for checking curve points satisfy their respective curve equations?
>
> There are also tables describing the cost of combined attacks on various curves, where NIST P224 already falls below the safe threshold. Because of that, I would recommend not implementing support for NIST P192 (since it would fair even worse).
>
> What are your thoughts?


I am calling into a function performing such a test at the end of the 
function parsing the public key:

  return ecc_is_pubkey_valid_full(ctx->curve, ctx->pub_key)

https://elixir.bootlin.com/linux/latest/source/crypto/ecc.c#L1458

Is that good 'enough' ?

    Stefan