6 ms·
This vulnerability has very little to do with P-521 per se. The issue is with ECDSA: any use of ECDSA with biased nonce generation, regardless of the elliptic c
by kwantam 2y ago
This vulnerability has very little to do with P-521 per se. The issue is with ECDSA: any use of ECDSA with biased nonce generation, regardless of the elliptic curve it's implemented over, immediately causes secret key leakage.
(Rant: All these years later, we're all still doing penance for the fact that Schnorr signatures were patented and so everyone used ECDSA instead. It's an absolute garbage fire of a signature scheme and should be abandoned yesterday for many reasons, e.g., no real proof of security, terrible footguns like this.)
- djao 2y agoSchnorr wouldn't have helped in this specific case, since Schnorr is equally vulnerable to biased nonces (https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf). EdDSA, which is essentially deterministic Schnorr, does solve the problem. Also, the use of P-521 didn't specifically cause the vulnerability, but the bad interaction between SHA512 and P-521 did play a role. It is unfortunate that nature conspired against us to make 2^511 - 1 a composite number. The fact that you have to go up to 521 bits to get a Mersenne prime whereas the natural target length for a hash output is 512 bits is the fatal interaction here.
- kwantam 2y agoExcellent points all around, and thank you for the pointer to the ECC slides :) (And indeed, nature could have been kinder to us and given us a Mersenne between 127 and 521...)
- GoblinSlayer 2y agoShouldn't there be another close enough prime? Like 2^510-1 or 2^511-19?
- SV_BubbleTime 2y agoI’m over here wondering why someone would want deterministic nonces. Isn’t it kind of the point to just roll random numbers? When would you calculate?
- ajb 2y agoIt says in the OP. Windows at the time did not provide a cryptographic quality random number source.
- denton-scratch 2y agoI saw that, and wondered why PuTTY didn't contain it's own good CSPRNG, something like Fortuna, if Windows didn't offer one.
- ajb 2y agoYou still need a source of entropy, which is easier for an OS. An app has to resort to the user moving the mouse or bashing keys, which is a worse UX, although I guess they did that for actual key generation (if PuTTY did that) but it would be annoying to do it every time you made a connection.
- CRConrad 2y ago> Schnorr signatures Never heard of (which probably demonstrates that I know pretty much nothing about cryptography?), so seeing a name spelled like "Schn...r" in this context makes at least me think of an entirely different luminary in the area. Thought it was a typo at first.