6 ms·

I would also like to see Curve25519 (as well as others) supported in all browsers. It really bothers me that while at least websites are making an effort to def

I would also like to see Curve25519 (as well as others) supported in all browsers. It really bothers me that while at least websites are making an effort to default to ECDHE encryption with PFS, they have to resort to using the low-performance, insecure and probably NSA-backdoored P-256 curve, because most browsers aren't supporting anything else right now.

sarciszewski 12y ago
I agree. Through PECL, PHP is soon going to have curve25519 support http://pecl.php.net/package/libsodium http://pecl.php.net/package/libsodium There's already a Node-Sodium package... https://github.com/paixaop/node-sodium https://github.com/paixaop/node-sodium Why can't browsers support it natively? (e.g. through NSS)
jvehent 12y ago
If anyone has the time and skills to implement these curves in NSS, I'm sure that the Firefox and Chrome security teams would be more than happy to enable them!
- sarciszewski 12y ago
  https://bugzilla.mozilla.org/show_bug.cgi?id=957105 https://bugzilla.mozilla.org/show_bug.cgi?id=957105 Looks like there's already a bug in Mozilla's tracker.
- tptacek 12y ago
  Very smart crypto implementors are already working on this codebase, aren't they?
  - jvehent 12y ago
    Not being one of them myself, I can only notice that their time is limited, and many much wanted improvements sit on the backburner waiting for a smart crypto implementor to work on them. NSS and OpenSSL are difficult codebases to work with, which may also explain why it's so hard to find people to work on them.
- higherpurpose 12y ago
  I'm not as worried about Chrome/Mozilla as I am about IE and Safari (including the mobile one).
- hsivonen 12y ago
  Why do you expect Firefox and Chrome to take patches as opposed to saying that patches should wait for specs from the TLS WG which waits for the CFRG to bless something? The political problem is that unless there's an authority whose blessing can be appealed to to justify inclusion, how do you decline curves from Microsoft Research and so-called NUMS curves? (Of course, it's not like the CFRG is a politically spoyless authority...)
tptacek 12y ago
You could cite sources on "probably NSA-backdoored" P-256, but they'd all boil down to "you can with some effort devise a scenario in which it would have been possible for NSA to influence the curve selection". You'd be in a very similar rhetorical position to the "controlled demolition" conspiracy theorists. We should, of course, demand rigid curves, and very few of the mainstream curves are rigid. But there's a difference between that and the assertion that P-256 is "probably backdoored"; for one thing, the latter assertion encourages people to adopt RSA, which is more fraught than ECC. That RSA vs. ECC issue is even worse in browsers, which I think makes your sentiment even less useful. In ground-up implementations, you can get some comfort from OAEP/PSS for RSA. No such help in TLS, where RSA still uses (terribly broken) PKCS1v15.
- mentat 12y ago
  My understanding of the issues with P-256 is that it's very easy for mistakes in the ECC implementation around certain points to leak information whereas with other curves it is not. Not quite "backdoored" but certainly not optimal in terms of security. Edit: based on http://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4x3.pdf http://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4...
  - tptacek 12y ago
    It's true that P-256 is more susceptible to implementation flaws than other curves, because P-256 wasn't designed to be misuse-resistant, unlike recent curves where that was a design goal. It's unlikely that any credible new protocol is going to adopt a NIST curve. They exist only for legacy support now. BULLRUN killed them. Fortunately, in this case I think hysteria actually served a good purpose. I do not think highly of crypto standards, and these ones in particular were dragging the industry down.
- MichaelGG 12y ago
  I'm going to display lots of ignorance in the hope you'll correct me. I thought these "possibly backdoored" curves needed a seed, and the creators provided a "provably random" one by hashing... a random number they provided. That alone is so silly and I'm not sure how anyone could take it seriously. But then, after that, it was discovered all those "provably random" seeds had a 1-in-a-million weakness. While this weakness alone doesn't comprise everything, it's an indicator that someone intentionally found those seeds so it might indicate something more. Is my poor understanding terribly wrong?

sarciszewski 12y ago

I agree. Through PECL, PHP is soon going to have curve25519 support http://pecl.php.net/package/libsodium http://pecl.php.net/package/libsodium There's already a Node-Sodium package... https://github.com/paixaop/node-sodium https://github.com/paixaop/node-sodium Why can't browsers support it natively? (e.g. through NSS)

jvehent 12y ago

If anyone has the time and skills to implement these curves in NSS, I'm sure that the Firefox and Chrome security teams would be more than happy to enable them!

sarciszewski 12y ago
https://bugzilla.mozilla.org/show_bug.cgi?id=957105 https://bugzilla.mozilla.org/show_bug.cgi?id=957105 Looks like there's already a bug in Mozilla's tracker.
tptacek 12y ago
Very smart crypto implementors are already working on this codebase, aren't they?
- jvehent 12y ago
  Not being one of them myself, I can only notice that their time is limited, and many much wanted improvements sit on the backburner waiting for a smart crypto implementor to work on them. NSS and OpenSSL are difficult codebases to work with, which may also explain why it's so hard to find people to work on them.
higherpurpose 12y ago
I'm not as worried about Chrome/Mozilla as I am about IE and Safari (including the mobile one).
hsivonen 12y ago
Why do you expect Firefox and Chrome to take patches as opposed to saying that patches should wait for specs from the TLS WG which waits for the CFRG to bless something? The political problem is that unless there's an authority whose blessing can be appealed to to justify inclusion, how do you decline curves from Microsoft Research and so-called NUMS curves? (Of course, it's not like the CFRG is a politically spoyless authority...)

tptacek 12y ago

You could cite sources on "probably NSA-backdoored" P-256, but they'd all boil down to "you can with some effort devise a scenario in which it would have been possible for NSA to influence the curve selection". You'd be in a very similar rhetorical position to the "controlled demolition" conspiracy theorists. We should, of course, demand rigid curves, and very few of the mainstream curves are rigid. But there's a difference between that and the assertion that P-256 is "probably backdoored"; for one thing, the latter assertion encourages people to adopt RSA, which is more fraught than ECC. That RSA vs. ECC issue is even worse in browsers, which I think makes your sentiment even less useful. In ground-up implementations, you can get some comfort from OAEP/PSS for RSA. No such help in TLS, where RSA still uses (terribly broken) PKCS1v15.

mentat 12y ago
My understanding of the issues with P-256 is that it's very easy for mistakes in the ECC implementation around certain points to leak information whereas with other curves it is not. Not quite "backdoored" but certainly not optimal in terms of security. Edit: based on http://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4x3.pdf http://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4...
- tptacek 12y ago
  It's true that P-256 is more susceptible to implementation flaws than other curves, because P-256 wasn't designed to be misuse-resistant, unlike recent curves where that was a design goal. It's unlikely that any credible new protocol is going to adopt a NIST curve. They exist only for legacy support now. BULLRUN killed them. Fortunately, in this case I think hysteria actually served a good purpose. I do not think highly of crypto standards, and these ones in particular were dragging the industry down.
MichaelGG 12y ago
I'm going to display lots of ignorance in the hope you'll correct me. I thought these "possibly backdoored" curves needed a seed, and the creators provided a "provably random" one by hashing... a random number they provided. That alone is so silly and I'm not sure how anyone could take it seriously. But then, after that, it was discovered all those "provably random" seeds had a 1-in-a-million weakness. While this weakness alone doesn't comprise everything, it's an indicator that someone intentionally found those seeds so it might indicate something more. Is my poor understanding terribly wrong?