2013-12-20 16:37:05 +00:00
|
|
|
>>> Flow 1 (client to server)
|
2016-08-17 23:55:15 +01:00
|
|
|
00000000 16 03 01 01 2a 01 00 01 26 03 03 ed f0 6d f4 95 |....*...&....m..|
|
|
|
|
|
00000010 fa e8 60 9d 08 16 a3 81 47 08 1b 93 2e fe c3 01 |..`.....G.......|
|
|
|
|
|
00000020 52 28 76 5f b3 e0 d7 0e 46 fd 82 00 00 ac c0 30 |R(v_....F......0|
|
crypto/ecdsa: make Sign safe with broken entropy sources
ECDSA is unsafe to use if an entropy source produces predictable
output for the ephemeral nonces. E.g., [Nguyen]. A simple
countermeasure is to hash the secret key, the message, and
entropy together to seed a CSPRNG, from which the ephemeral key
is derived.
Fixes #9452
--
This is a minimalist (in terms of patch size) solution, though
not the most parsimonious in its use of primitives:
- csprng_key = ChopMD-256(SHA2-512(priv.D||entropy||hash))
- reader = AES-256-CTR(k=csprng_key)
This, however, provides at most 128-bit collision-resistance,
so that Adv will have a term related to the number of messages
signed that is significantly worse than plain ECDSA. This does
not seem to be of any practical importance.
ChopMD-256(SHA2-512(x)) is used, rather than SHA2-256(x), for
two sets of reasons:
*Practical:* SHA2-512 has a larger state and 16 more rounds; it
is likely non-generically stronger than SHA2-256. And, AFAIK,
cryptanalysis backs this up. (E.g., [Biryukov] gives a
distinguisher on 47-round SHA2-256 with cost < 2^85.) This is
well below a reasonable security-strength target.
*Theoretical:* [Coron] and [Chang] show that Chop-MD(F(x)) is
indifferentiable from a random oracle for slightly beyond the
birthday barrier. It seems likely that this makes a generic
security proof that this construction remains UF-CMA is
possible in the indifferentiability framework.
--
Many thanks to Payman Mohassel for reviewing this construction;
any mistakes are mine, however. And, as he notes, reusing the
private key in this way means that the generic-group (non-RO)
proof of ECDSA's security given in [Brown] no longer directly
applies.
--
[Brown]: http://www.cacr.math.uwaterloo.ca/techreports/2000/corr2000-54.ps
"Brown. The exact security of ECDSA. 2000"
[Coron]: https://www.cs.nyu.edu/~puniya/papers/merkle.pdf
"Coron et al. Merkle-Damgard revisited. 2005"
[Chang]: https://www.iacr.org/archive/fse2008/50860436/50860436.pdf
"Chang and Nandi. Improved indifferentiability security analysis
of chopMD hash function. 2008"
[Biryukov]: http://www.iacr.org/archive/asiacrypt2011/70730269/70730269.pdf
"Biryukov et al. Second-order differential collisions for reduced
SHA-256. 2011"
[Nguyen]: ftp://ftp.di.ens.fr/pub/users/pnguyen/PubECDSA.ps
"Nguyen and Shparlinski. The insecurity of the elliptic curve
digital signature algorithm with partially known nonces. 2003"
New tests:
TestNonceSafety: Check that signatures are safe even with a
broken entropy source.
TestINDCCA: Check that signatures remain non-deterministic
with a functional entropy source.
Updated "golden" KATs in crypto/tls/testdata that use ECDSA suites.
Change-Id: I55337a2fbec2e42a36ce719bd2184793682d678a
Reviewed-on: https://go-review.googlesource.com/3340
Reviewed-by: Adam Langley <agl@golang.org>
2015-01-27 07:00:21 +00:00
|
|
|
00000030 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 |.,.(.$..........|
|
|
|
|
|
00000040 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 |...k.j.i.h.9.8.7|
|
|
|
|
|
00000050 00 36 00 88 00 87 00 86 00 85 c0 32 c0 2e c0 2a |.6.........2...*|
|
|
|
|
|
00000060 c0 26 c0 0f c0 05 00 9d 00 3d 00 35 00 84 c0 2f |.&.......=.5.../|
|
|
|
|
|
00000070 c0 2b c0 27 c0 23 c0 13 c0 09 00 a4 00 a2 00 a0 |.+.'.#..........|
|
|
|
|
|
00000080 00 9e 00 67 00 40 00 3f 00 3e 00 33 00 32 00 31 |...g.@.?.>.3.2.1|
|
|
|
|
|
00000090 00 30 00 9a 00 99 00 98 00 97 00 45 00 44 00 43 |.0.........E.D.C|
|
|
|
|
|
000000a0 00 42 c0 31 c0 2d c0 29 c0 25 c0 0e c0 04 00 9c |.B.1.-.).%......|
|
|
|
|
|
000000b0 00 3c 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c |.<./...A........|
|
|
|
|
|
000000c0 c0 02 00 05 00 04 c0 12 c0 08 00 16 00 13 00 10 |................|
|
2016-08-17 23:55:15 +01:00
|
|
|
000000d0 00 0d c0 0d c0 03 00 0a 00 ff 01 00 00 51 00 0b |.............Q..|
|
|
|
|
|
000000e0 00 04 03 00 01 02 00 0a 00 1c 00 1a 00 17 00 19 |................|
|
|
|
|
|
000000f0 00 1c 00 1b 00 18 00 1a 00 16 00 0e 00 0d 00 0b |................|
|
|
|
|
|
00000100 00 0c 00 09 00 0a 00 0d 00 20 00 1e 06 01 06 02 |......... ......|
|
|
|
|
|
00000110 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03 01 |................|
|
|
|
|
|
00000120 03 02 03 03 02 01 02 02 02 03 00 0f 00 01 01 |...............|
|
2013-12-20 16:37:05 +00:00
|
|
|
>>> Flow 2 (server to client)
|
crypto/ecdsa: make Sign safe with broken entropy sources
ECDSA is unsafe to use if an entropy source produces predictable
output for the ephemeral nonces. E.g., [Nguyen]. A simple
countermeasure is to hash the secret key, the message, and
entropy together to seed a CSPRNG, from which the ephemeral key
is derived.
Fixes #9452
--
This is a minimalist (in terms of patch size) solution, though
not the most parsimonious in its use of primitives:
- csprng_key = ChopMD-256(SHA2-512(priv.D||entropy||hash))
- reader = AES-256-CTR(k=csprng_key)
This, however, provides at most 128-bit collision-resistance,
so that Adv will have a term related to the number of messages
signed that is significantly worse than plain ECDSA. This does
not seem to be of any practical importance.
ChopMD-256(SHA2-512(x)) is used, rather than SHA2-256(x), for
two sets of reasons:
*Practical:* SHA2-512 has a larger state and 16 more rounds; it
is likely non-generically stronger than SHA2-256. And, AFAIK,
cryptanalysis backs this up. (E.g., [Biryukov] gives a
distinguisher on 47-round SHA2-256 with cost < 2^85.) This is
well below a reasonable security-strength target.
*Theoretical:* [Coron] and [Chang] show that Chop-MD(F(x)) is
indifferentiable from a random oracle for slightly beyond the
birthday barrier. It seems likely that this makes a generic
security proof that this construction remains UF-CMA is
possible in the indifferentiability framework.
--
Many thanks to Payman Mohassel for reviewing this construction;
any mistakes are mine, however. And, as he notes, reusing the
private key in this way means that the generic-group (non-RO)
proof of ECDSA's security given in [Brown] no longer directly
applies.
--
[Brown]: http://www.cacr.math.uwaterloo.ca/techreports/2000/corr2000-54.ps
"Brown. The exact security of ECDSA. 2000"
[Coron]: https://www.cs.nyu.edu/~puniya/papers/merkle.pdf
"Coron et al. Merkle-Damgard revisited. 2005"
[Chang]: https://www.iacr.org/archive/fse2008/50860436/50860436.pdf
"Chang and Nandi. Improved indifferentiability security analysis
of chopMD hash function. 2008"
[Biryukov]: http://www.iacr.org/archive/asiacrypt2011/70730269/70730269.pdf
"Biryukov et al. Second-order differential collisions for reduced
SHA-256. 2011"
[Nguyen]: ftp://ftp.di.ens.fr/pub/users/pnguyen/PubECDSA.ps
"Nguyen and Shparlinski. The insecurity of the elliptic curve
digital signature algorithm with partially known nonces. 2003"
New tests:
TestNonceSafety: Check that signatures are safe even with a
broken entropy source.
TestINDCCA: Check that signatures remain non-deterministic
with a functional entropy source.
Updated "golden" KATs in crypto/tls/testdata that use ECDSA suites.
Change-Id: I55337a2fbec2e42a36ce719bd2184793682d678a
Reviewed-on: https://go-review.googlesource.com/3340
Reviewed-by: Adam Langley <agl@golang.org>
2015-01-27 07:00:21 +00:00
|
|
|
00000000 16 03 03 00 31 02 00 00 2d 03 03 00 00 00 00 00 |....1...-.......|
|
2013-12-20 16:37:05 +00:00
|
|
|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
|
crypto/ecdsa: make Sign safe with broken entropy sources
ECDSA is unsafe to use if an entropy source produces predictable
output for the ephemeral nonces. E.g., [Nguyen]. A simple
countermeasure is to hash the secret key, the message, and
entropy together to seed a CSPRNG, from which the ephemeral key
is derived.
Fixes #9452
--
This is a minimalist (in terms of patch size) solution, though
not the most parsimonious in its use of primitives:
- csprng_key = ChopMD-256(SHA2-512(priv.D||entropy||hash))
- reader = AES-256-CTR(k=csprng_key)
This, however, provides at most 128-bit collision-resistance,
so that Adv will have a term related to the number of messages
signed that is significantly worse than plain ECDSA. This does
not seem to be of any practical importance.
ChopMD-256(SHA2-512(x)) is used, rather than SHA2-256(x), for
two sets of reasons:
*Practical:* SHA2-512 has a larger state and 16 more rounds; it
is likely non-generically stronger than SHA2-256. And, AFAIK,
cryptanalysis backs this up. (E.g., [Biryukov] gives a
distinguisher on 47-round SHA2-256 with cost < 2^85.) This is
well below a reasonable security-strength target.
*Theoretical:* [Coron] and [Chang] show that Chop-MD(F(x)) is
indifferentiable from a random oracle for slightly beyond the
birthday barrier. It seems likely that this makes a generic
security proof that this construction remains UF-CMA is
possible in the indifferentiability framework.
--
Many thanks to Payman Mohassel for reviewing this construction;
any mistakes are mine, however. And, as he notes, reusing the
private key in this way means that the generic-group (non-RO)
proof of ECDSA's security given in [Brown] no longer directly
applies.
--
[Brown]: http://www.cacr.math.uwaterloo.ca/techreports/2000/corr2000-54.ps
"Brown. The exact security of ECDSA. 2000"
[Coron]: https://www.cs.nyu.edu/~puniya/papers/merkle.pdf
"Coron et al. Merkle-Damgard revisited. 2005"
[Chang]: https://www.iacr.org/archive/fse2008/50860436/50860436.pdf
"Chang and Nandi. Improved indifferentiability security analysis
of chopMD hash function. 2008"
[Biryukov]: http://www.iacr.org/archive/asiacrypt2011/70730269/70730269.pdf
"Biryukov et al. Second-order differential collisions for reduced
SHA-256. 2011"
[Nguyen]: ftp://ftp.di.ens.fr/pub/users/pnguyen/PubECDSA.ps
"Nguyen and Shparlinski. The insecurity of the elliptic curve
digital signature algorithm with partially known nonces. 2003"
New tests:
TestNonceSafety: Check that signatures are safe even with a
broken entropy source.
TestINDCCA: Check that signatures remain non-deterministic
with a functional entropy source.
Updated "golden" KATs in crypto/tls/testdata that use ECDSA suites.
Change-Id: I55337a2fbec2e42a36ce719bd2184793682d678a
Reviewed-on: https://go-review.googlesource.com/3340
Reviewed-by: Adam Langley <agl@golang.org>
2015-01-27 07:00:21 +00:00
|
|
|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 c0 14 00 00 |................|
|
2016-08-17 23:55:15 +01:00
|
|
|
00000030 05 ff 01 00 01 00 16 03 03 02 59 0b 00 02 55 00 |..........Y...U.|
|
|
|
|
|
00000040 02 52 00 02 4f 30 82 02 4b 30 82 01 b4 a0 03 02 |.R..O0..K0......|
|
|
|
|
|
00000050 01 02 02 09 00 e8 f0 9d 3f e2 5b ea a6 30 0d 06 |........?.[..0..|
|
|
|
|
|
00000060 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 1f 31 0b |.*.H........0.1.|
|
|
|
|
|
00000070 30 09 06 03 55 04 0a 13 02 47 6f 31 10 30 0e 06 |0...U....Go1.0..|
|
|
|
|
|
00000080 03 55 04 03 13 07 47 6f 20 52 6f 6f 74 30 1e 17 |.U....Go Root0..|
|
|
|
|
|
00000090 0d 31 36 30 31 30 31 30 30 30 30 30 30 5a 17 0d |.160101000000Z..|
|
|
|
|
|
000000a0 32 35 30 31 30 31 30 30 30 30 30 30 5a 30 1a 31 |250101000000Z0.1|
|
|
|
|
|
000000b0 0b 30 09 06 03 55 04 0a 13 02 47 6f 31 0b 30 09 |.0...U....Go1.0.|
|
|
|
|
|
000000c0 06 03 55 04 03 13 02 47 6f 30 81 9f 30 0d 06 09 |..U....Go0..0...|
|
|
|
|
|
000000d0 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 |*.H............0|
|
|
|
|
|
000000e0 81 89 02 81 81 00 db 46 7d 93 2e 12 27 06 48 bc |.......F}...'.H.|
|
|
|
|
|
000000f0 06 28 21 ab 7e c4 b6 a2 5d fe 1e 52 45 88 7a 36 |.(!.~...]..RE.z6|
|
|
|
|
|
00000100 47 a5 08 0d 92 42 5b c2 81 c0 be 97 79 98 40 fb |G....B[.....y.@.|
|
|
|
|
|
00000110 4f 6d 14 fd 2b 13 8b c2 a5 2e 67 d8 d4 09 9e d6 |Om..+.....g.....|
|
|
|
|
|
00000120 22 38 b7 4a 0b 74 73 2b c2 34 f1 d1 93 e5 96 d9 |"8.J.ts+.4......|
|
|
|
|
|
00000130 74 7b f3 58 9f 6c 61 3c c0 b0 41 d4 d9 2b 2b 24 |t{.X.la<..A..++$|
|
|
|
|
|
00000140 23 77 5b 1c 3b bd 75 5d ce 20 54 cf a1 63 87 1d |#w[.;.u]. T..c..|
|
|
|
|
|
00000150 1e 24 c4 f3 1d 1a 50 8b aa b6 14 43 ed 97 a7 75 |.$....P....C...u|
|
|
|
|
|
00000160 62 f4 14 c8 52 d7 02 03 01 00 01 a3 81 93 30 81 |b...R.........0.|
|
|
|
|
|
00000170 90 30 0e 06 03 55 1d 0f 01 01 ff 04 04 03 02 05 |.0...U..........|
|
|
|
|
|
00000180 a0 30 1d 06 03 55 1d 25 04 16 30 14 06 08 2b 06 |.0...U.%..0...+.|
|
|
|
|
|
00000190 01 05 05 07 03 01 06 08 2b 06 01 05 05 07 03 02 |........+.......|
|
|
|
|
|
000001a0 30 0c 06 03 55 1d 13 01 01 ff 04 02 30 00 30 19 |0...U.......0.0.|
|
|
|
|
|
000001b0 06 03 55 1d 0e 04 12 04 10 9f 91 16 1f 43 43 3e |..U..........CC>|
|
|
|
|
|
000001c0 49 a6 de 6d b6 80 d7 9f 60 30 1b 06 03 55 1d 23 |I..m....`0...U.#|
|
|
|
|
|
000001d0 04 14 30 12 80 10 48 13 49 4d 13 7e 16 31 bb a3 |..0...H.IM.~.1..|
|
|
|
|
|
000001e0 01 d5 ac ab 6e 7b 30 19 06 03 55 1d 11 04 12 30 |....n{0...U....0|
|
|
|
|
|
000001f0 10 82 0e 65 78 61 6d 70 6c 65 2e 67 6f 6c 61 6e |...example.golan|
|
|
|
|
|
00000200 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 |g0...*.H........|
|
|
|
|
|
00000210 03 81 81 00 9d 30 cc 40 2b 5b 50 a0 61 cb ba e5 |.....0.@+[P.a...|
|
|
|
|
|
00000220 53 58 e1 ed 83 28 a9 58 1a a9 38 a4 95 a1 ac 31 |SX...(.X..8....1|
|
|
|
|
|
00000230 5a 1a 84 66 3d 43 d3 2d d9 0b f2 97 df d3 20 64 |Z..f=C.-...... d|
|
|
|
|
|
00000240 38 92 24 3a 00 bc cf 9c 7d b7 40 20 01 5f aa d3 |8.$:....}.@ ._..|
|
|
|
|
|
00000250 16 61 09 a2 76 fd 13 c3 cc e1 0c 5c ee b1 87 82 |.a..v......\....|
|
|
|
|
|
00000260 f1 6c 04 ed 73 bb b3 43 77 8d 0c 1c f1 0f a1 d8 |.l..s..Cw.......|
|
|
|
|
|
00000270 40 83 61 c9 4c 72 2b 9d ae db 46 06 06 4d f4 c1 |@.a.Lr+...F..M..|
|
|
|
|
|
00000280 b3 3e c0 d1 bd 42 d4 db fe 3d 13 60 84 5c 21 d3 |.>...B...=.`.\!.|
|
|
|
|
|
00000290 3b e9 fa e7 16 03 03 00 cd 0c 00 00 c9 03 00 17 |;...............|
|
|
|
|
|
000002a0 41 04 1e 18 37 ef 0d 19 51 88 35 75 71 b5 e5 54 |A...7...Q.5uq..T|
|
|
|
|
|
000002b0 5b 12 2e 8f 09 67 fd a7 24 20 3e b2 56 1c ce 97 |[....g..$ >.V...|
|
|
|
|
|
000002c0 28 5e f8 2b 2d 4f 9e f1 07 9f 6c 4b 5b 83 56 e2 |(^.+-O....lK[.V.|
|
|
|
|
|
000002d0 32 42 e9 58 b6 d7 49 a6 b5 68 1a 41 03 56 6b dc |2B.X..I..h.A.Vk.|
|
|
|
|
|
000002e0 5a 89 05 01 00 80 cb ff 0a db 63 b1 3f 09 58 df |Z.........c.?.X.|
|
|
|
|
|
000002f0 d2 0e 55 e8 50 a0 07 31 fa 3e 79 c6 9f c0 0a 3c |..U.P..1.>y....<|
|
|
|
|
|
00000300 fe ee 18 24 2f cb 20 2b 8f 22 64 28 a4 9b 6e 49 |...$/. +."d(..nI|
|
|
|
|
|
00000310 5a d6 b4 85 d5 35 db fc b8 06 ec 34 4a a3 b3 2f |Z....5.....4J../|
|
|
|
|
|
00000320 11 50 5d cb 9f 65 eb d7 90 03 11 10 e6 ac 3e ad |.P]..e........>.|
|
|
|
|
|
00000330 a3 46 82 ba d6 90 a2 8c 2b 26 ff f0 bb bf 52 fc |.F......+&....R.|
|
|
|
|
|
00000340 d9 30 90 c6 e4 d5 be ce a0 fb 55 0d 31 9c f6 3e |.0........U.1..>|
|
|
|
|
|
00000350 df 55 05 3c c6 17 82 3c ee 65 0f a3 98 96 e2 0a |.U.<...<.e......|
|
|
|
|
|
00000360 47 3a fe b7 8f 4f 16 03 03 00 04 0e 00 00 00 |G:...O.........|
|
2013-12-20 16:37:05 +00:00
|
|
|
>>> Flow 3 (client to server)
|
2016-08-17 23:55:15 +01:00
|
|
|
00000000 16 03 03 00 46 10 00 00 42 41 04 35 e0 c8 d2 37 |....F...BA.5...7|
|
|
|
|
|
00000010 a8 cf 54 0b dd 6d f4 2d cf aa 80 ea 87 97 f3 b8 |..T..m.-........|
|
|
|
|
|
00000020 e7 e6 dc 0e 68 8c 64 19 55 e9 2e d7 5c d7 bb b8 |....h.d.U...\...|
|
|
|
|
|
00000030 4e 6d cc 4f f1 6c 8f 48 22 b7 a9 70 a3 a8 8f 21 |Nm.O.l.H"..p...!|
|
|
|
|
|
00000040 ca 9c 7c 51 51 9a 73 16 5a b5 69 14 03 03 00 01 |..|QQ.s.Z.i.....|
|
|
|
|
|
00000050 01 16 03 03 00 40 a3 cb c6 aa 9f c8 8f 2c 0d ec |.....@.......,..|
|
|
|
|
|
00000060 93 0d 7e ae c0 69 35 a3 d0 55 78 92 a5 e6 43 10 |..~..i5..Ux...C.|
|
|
|
|
|
00000070 f3 ae 2d 22 60 59 ea 80 79 c6 84 8b fa ea 19 91 |..-"`Y..y.......|
|
|
|
|
|
00000080 0f 64 25 89 a3 54 52 31 95 03 65 d1 1b e4 7d b6 |.d%..TR1..e...}.|
|
|
|
|
|
00000090 a4 2a 9d 9f 12 44 |.*...D|
|
2013-12-20 16:37:05 +00:00
|
|
|
>>> Flow 4 (server to client)
|
|
|
|
|
00000000 14 03 03 00 01 01 16 03 03 00 40 00 00 00 00 00 |..........@.....|
|
2016-08-17 23:55:15 +01:00
|
|
|
00000010 00 00 00 00 00 00 00 00 00 00 00 e7 85 23 79 ac |.............#y.|
|
|
|
|
|
00000020 40 04 a0 c5 84 71 8f 2e b2 f3 b6 13 82 7d 4b 39 |@....q.......}K9|
|
|
|
|
|
00000030 86 76 62 fc af ec 3b e2 ba 41 97 d3 1b 67 29 c8 |.vb...;..A...g).|
|
|
|
|
|
00000040 34 c4 42 f6 f3 32 dd 46 0a 02 1d 17 03 03 00 40 |4.B..2.F.......@|
|
2013-12-20 16:37:05 +00:00
|
|
|
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
|
2016-08-17 23:55:15 +01:00
|
|
|
00000060 62 26 80 66 d7 9f 00 4b cf 39 f7 13 ae 3b 1b 09 |b&.f...K.9...;..|
|
|
|
|
|
00000070 6a bc 08 eb ef ba 55 69 d7 87 40 48 79 71 5a fa |j.....Ui..@HyqZ.|
|
|
|
|
|
00000080 94 1d 0e 2d 7e 0c 2a 8e df 8b 46 44 9e 0f 6c 46 |...-~.*...FD..lF|
|
2013-12-20 16:37:05 +00:00
|
|
|
00000090 15 03 03 00 30 00 00 00 00 00 00 00 00 00 00 00 |....0...........|
|
2016-08-17 23:55:15 +01:00
|
|
|
000000a0 00 00 00 00 00 03 a4 fd 6c a7 32 cd 5c 7b fd de |........l.2.\{..|
|
|
|
|
|
000000b0 cf 87 c6 62 3a 13 d6 d9 28 78 07 b7 89 16 bb dd |...b:...(x......|
|
|
|
|
|
000000c0 f1 f1 4a 95 04 |..J..|
|
