Minerva: Practically exploitable side-channel leakage in ECDSA implementations
minerva.crocs.fi.muni.cz
Minerva: Practically exploitable side-channel leakage in ECDSA implementations
1–10 of 55 posts
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#2There’s no reason I’m aware of to use ECDSA over other available crypto. Don’t use ECDSA.
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#3There’s no reason I’m aware of to use ECDSA over other available crypto. Don’t use ECDSA.
This impacts EdDSA as well, the Edwards-curve Schnorr-based system that is a gold standard for signing crypto. While I agree that you should avoid ECDSA, implementation errors can happen to anything.
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#4There’s no reason I’m aware of to use ECDSA over other available crypto. Don’t use ECDSA.
1. They show libgcrypt managed to have the bug in EdDSA (https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=c...).
2. People need to use ECDSA for same reason they need to use RSA: compatibility. In particular, EdDSA webpki certificates will likely never happen (https://cabforum.org/pipermail/servercert-wg/2019-June/00087...).
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#5previously: https://news.ycombinator.com/item?id=21136946
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#6There’s no reason I’m aware of to use ECDSA over other available crypto. Don’t use ECDSA.
1. They show libgcrypt managed to have the bug in EdDSA ( https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=c... ). 2. People need to use ECDSA for same reason they need to use RSA: compatibility. In particular, EdDSA webpki certificates will likely never happen ( https://cabforum.org/pipermail/servercert-wg/2019-June/00087... ).
But, if you fear and loathe ECDSA (and I do as well), it's probably a good idea to get in early against protocols that seek to deploy more of it. For instance, DNSSEC, which is barely deployed anywhere on the Internet, is just now (as in, resolvers couldn't reliably verify ECC records until recently) introducing ECC support --- with ECDSA.
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#7This looks like a really phenomenal writeup, with worked examples. The underlying math and algorithm stuff here is applicable to other attacks; it looks like this is worth a close read.
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#8Earlier quoted context omitted.
1. They show libgcrypt managed to have the bug in EdDSA ( https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=c... ). 2. People need to use ECDSA for same reason they need to use RSA: compatibility. In particular, EdDSA webpki certificates will likely never happen ( https://cabforum.org/pipermail/servercert-wg/2019-June/00087... ).
But, if you fear and loathe ECDSA (and I do as well), it's probably a good idea to get in early against protocols that seek to deploy more of it. For instance, DNSSEC, which is barely deployed anywhere on the Internet, is just now (as in, resolvers couldn't reliably verify ECC records until recently) introducing ECC support --- with ECDSA.
I think EdDSA desperately needs to be allowed in FIPS certified hardware, so that secure hardware will have support for EdDSA so that people who have to store keys in secure hardware will be able to use it. I mean HSMs, smart cards, secure enclaves, TPMs, things with a ATECC508A, etc.
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#9> the trustworthiness of NIST-produced curves being questioned after revelations that the NSA willingly inserts backdoors into software, hardware components and published standards were made; well-known cryptographers have expressed doubts about how the NIST curves were designed, and voluntary tainting has already been proved in the past.
https://wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_...
Re: Minerva: Practically exploitable side-channel leakage in ECDSA implementations
#10> the trustworthiness of NIST-produced curves being questioned after revelations that the NSA willingly inserts backdoors into software, hardware components and published standards were made; well-known cryptographers have expressed doubts about how the NIST curves were designed, and voluntary tainting has already been proved in the past. https://wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_...
'tptacek would write that no reputable cryptographer believes the NIST curves themselves are backdoored.