How to Textbook key exchange manipulate curve standards: - PowerPoint PPT Presentation

� � � � � How to Textbook key exchange manipulate curve standards: using standard point P a white paper for the black hat on a standard elliptic curve E : Alice’s Bob’s Daniel J. Bernstein secret key a secret key b Tung Chou Chitchanok Chuengsatiansup Andreas H¨ ulsing Alice’s Bob’s public key public key Eran Lambooij aP bP ▲ Tanja Lange � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ Ruben Niederhagen { Alice ; Bob } ’s = { Bob ; Alice } ’s Christine van Vredendaal shared secret shared secret abP baP bada55.cr.yp.to

� � � � � How to Textbook key exchange manipulate curve standards: using standard point P a white paper for the black hat on a standard elliptic curve E : Alice’s Bob’s Daniel J. Bernstein secret key a secret key b Tung Chou Chitchanok Chuengsatiansup Andreas H¨ ulsing Alice’s Bob’s public key public key Eran Lambooij aP bP ▲ Tanja Lange � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ Ruben Niederhagen { Alice ; Bob } ’s = { Bob ; Alice } ’s Christine van Vredendaal shared secret shared secret abP baP bada55.cr.yp.to Security depends on choice of E .

� � � � � � � to Textbook key exchange Our manipulate curve standards: using standard point P white paper for the black hat on a standard elliptic curve E : Alice’s Bob’s Alice’s J. Bernstein secret key a secret key b secret Chou Chitchanok Chuengsatiansup Andreas H¨ ulsing Alice’s Bob’s Alice’s public key public key public Lambooij aP bP aP ▲ Lange � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ Niederhagen { Alice ; Bob } ’s = { Bob ; Alice } ’s { Alice ; Bob Christine van Vredendaal shared secret shared secret shared abP baP abP bada55.cr.yp.to Security depends on choice of E .

� � � � � � � � Textbook key exchange Our partner choice of curve standards: using standard point P r the black hat on a standard elliptic curve E : Alice’s Bob’s Alice’s Bernstein secret key a secret key b secret key a Chuengsatiansup Alice’s Bob’s Alice’s public key public key public key aP bP aP ▲ ▲ � rrrrrrr ▲ ▲ ▲ ▲ ▲ � rrrrr ▲ ▲ ▲ ▲ ▲ Niederhagen { Alice ; Bob } ’s = { Bob ; Alice } ’s { Alice ; Bob } ’s redendaal = shared secret shared secret shared secret abP baP abP bada55.cr.yp.to Security depends on choice of E .

� � � � � � � � � � � Textbook key exchange Our partner Jerry’s choice of E; P rds: using standard point P black hat on a standard elliptic curve E : Alice’s Bob’s Alice’s Bob’s secret key a secret key b secret key a secret k Chuengsatiansup Alice’s Bob’s Alice’s Bob’s public key public key public key public aP bP aP bP ▲ ▲ � rrrrrrr ▲ � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ { Alice ; Bob } ’s = { Bob ; Alice } ’s { Alice ; Bob } ’s = { Bob ; Alice shared secret shared secret shared secret shared sec abP baP abP baP Security depends on choice of E .

� � � � � � � � � � � � Textbook key exchange Our partner Jerry’s choice of E; P using standard point P on a standard elliptic curve E : Alice’s Bob’s Alice’s Bob’s secret key a secret key b secret key a secret key b Alice’s Bob’s Alice’s Bob’s public key public key public key public key aP bP aP bP ▲ ▲ � rrrrrrr ▲ � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ { Alice ; Bob } ’s = { Bob ; Alice } ’s { Alice ; Bob } ’s = { Bob ; Alice } ’s shared secret shared secret shared secret shared secret abP baP abP baP Security depends on choice of E .

� � � � � � � � � � � � Textbook key exchange Our partner Jerry’s choice of E; P using standard point P on a standard elliptic curve E : Alice’s Bob’s Alice’s Bob’s secret key a secret key b secret key a secret key b Alice’s Bob’s Alice’s Bob’s public key public key public key public key aP bP aP bP ▲ ▲ � rrrrrrr ▲ � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ { Alice ; Bob } ’s = { Bob ; Alice } ’s { Alice ; Bob } ’s = { Bob ; Alice } ’s shared secret shared secret shared secret shared secret abP baP abP baP Security depends on choice of E . Can we exploit this picture?

� � � � � � � � � � � ok key exchange Our partner Jerry’s Exploitabilit choice of E; P standard point P public criteria standard elliptic curve E : Alice’s Bob’s Alice’s Bob’s secret key a secret key b secret key a secret key b Alice’s Bob’s Alice’s Bob’s public key public key public key public key aP bP aP bP ▲ ▲ � rrrrrrr ▲ � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ; Bob } ’s = { Bob ; Alice } ’s { Alice ; Bob } ’s = { Bob ; Alice } ’s red secret shared secret shared secret shared secret bP baP abP baP Security depends on choice of E . Can we exploit this picture?

� � � � � � � � � � exchange Our partner Jerry’s Exploitability depends choice of E; P oint P public criteria for accepting elliptic curve E : Bob’s Alice’s Bob’s secret key b secret key a secret key b Bob’s Alice’s Bob’s public key public key public key bP aP bP ▲ rrrr � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ = { Bob ; Alice } ’s { Alice ; Bob } ’s = { Bob ; Alice } ’s shared secret shared secret shared secret baP abP baP ends on choice of E . Can we exploit this picture?

� � � � � � � � Our partner Jerry’s Exploitability depends on choice of E; P public criteria for accepting E curve E : Bob’s Alice’s Bob’s key b secret key a secret key b Bob’s Alice’s Bob’s public key public key public key P aP bP ▲ � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ Alice } ’s { Alice ; Bob } ’s = { Bob ; Alice } ’s secret shared secret shared secret aP abP baP choice of E . Can we exploit this picture?

� � � � � � � Our partner Jerry’s Exploitability depends on choice of E; P public criteria for accepting E; P . Alice’s Bob’s secret key a secret key b Alice’s Bob’s public key public key aP bP ▲ � rrrrrrr ▲ ▲ ▲ ▲ ▲ ▲ { Alice ; Bob } ’s = { Bob ; Alice } ’s shared secret shared secret abP baP Can we exploit this picture?

� � � � � � � Our partner Jerry’s Exploitability depends on choice of E; P public criteria for accepting E; P . Extensive ECC literature: Alice’s Bob’s Pollard rho breaks small E , secret key a secret key b Pohlig–Hellman breaks most E , MOV/FR breaks some E , SmartASS breaks some E , etc. Alice’s Bob’s public key public key Assume that public will accept aP bP ▲ � rrrrrrr ▲ ▲ ▲ any E not publicly broken. ▲ ▲ ▲ { Alice ; Bob } ’s = { Bob ; Alice } ’s shared secret shared secret abP baP Can we exploit this picture?

� � � � � � � Our partner Jerry’s Exploitability depends on choice of E; P public criteria for accepting E; P . Extensive ECC literature: Alice’s Bob’s Pollard rho breaks small E , secret key a secret key b Pohlig–Hellman breaks most E , MOV/FR breaks some E , SmartASS breaks some E , etc. Alice’s Bob’s public key public key Assume that public will accept aP bP ▲ � rrrrrrr ▲ ▲ ▲ any E not publicly broken. ▲ ▲ ▲ { Alice ; Bob } ’s = { Bob ; Alice } ’s Assume that we’ve figured out shared secret shared secret how to break another curve E . abP baP Can we exploit this picture?

� � � � � � � Our partner Jerry’s Exploitability depends on choice of E; P public criteria for accepting E; P . Extensive ECC literature: Alice’s Bob’s Pollard rho breaks small E , secret key a secret key b Pohlig–Hellman breaks most E , MOV/FR breaks some E , SmartASS breaks some E , etc. Alice’s Bob’s public key public key Assume that public will accept aP bP ▲ � rrrrrrr ▲ ▲ ▲ any E not publicly broken. ▲ ▲ ▲ { Alice ; Bob } ’s = { Bob ; Alice } ’s Assume that we’ve figured out shared secret shared secret how to break another curve E . abP baP Jerry standardizes this curve. Can we exploit this picture? Alice and Bob use it.

� � � � � � Our partner Jerry’s Exploitability depends on Is first assumption choice of E; P public criteria for accepting E; P . Would the Extensive ECC literature: any curve Alice’s Bob’s Pollard rho breaks small E , that survives secret key a secret key b Pohlig–Hellman breaks most E , MOV/FR breaks some E , SmartASS breaks some E , etc. Alice’s Bob’s public key public key Assume that public will accept aP bP ▲ � rrrrrrr ▲ ▲ ▲ any E not publicly broken. ▲ ▲ ▲ ; Bob } ’s = { Bob ; Alice } ’s Assume that we’ve figured out red secret shared secret how to break another curve E . bP baP Jerry standardizes this curve. e exploit this picture? Alice and Bob use it.