A miña propia seguridade curva ECC e análise de selección

Máis moderno Crypto uso Elliptic Curve cifrado (ECC), que, cun tamaño menor clave e reducir o poder de computación, dar forza do sistema tradicional de cifrado coñecido como DH (Diffie-Hellman) ou RSA (Rivest, Shamir e Adleman) seguridade equivalente.

Non todo o mundo sabe que o cifrado ECC é seleccionado para todas as aplicacións de cifrado de futuros e que mesmo TLS / SSL (cifrado empregado para protexer a web) está movendo ECC.

Penso moito dos chamados "produtos de cifrado de propiedade", que abandonou a RSA e DH vai con alternativas ECC, que tenden a usar ECC tamaño da clave bits arbitrario, aínda sen especificar o tipo de cifrado ECC afacerse.

Con todo, hai unha gran confusión arredor das curvas elípticas, cunha chea de nomes diferentes e tamaño da clave, facendo difícil para un non cifrada experimentado usuario para facer a súa propia figura, ao avaliar algunhas cousas Crypto.

Por mor da confusión tan difundida que decidín facer a miña propia análise para descubrir cales son as mellores curvas de cifrado e tamaño de chave ECC ECC dereito de usar.

Esta análise quere proporcionar unha selección baseada en industria de seguridade entre varias curvas e tamaños de clave, deixando os matemáticos e crypto consideracións analíticas que xa ser feito ao longo dos anos, resumindo as varias opcións tomadas en varios estándares e protocolos de seguridade.

En primeiro lugar, a conclusión.

Da miña análise só as seguintes curvas ECC deben ser considerados para o seu uso en sistemas de cifrado, por que é o único seleccionado entre diferentes autoridades (ANSI, NSA, SAG, NIST, ECC Brainpool), diferentes patróns de protocolo de seguridade (IPSec, OpenPGP, ZRTP, Kerberos, SSL / TLS) eo único correspondentes requisitos de seguridade NSA Suite B (estándar de feito tamén para o ámbito militar da OTAN):

• Elliptic Curve Prime 256 bits - P-256
• Elliptic Curve Prime 384 bits - P-384

co opcional, só para realmente paranoico que desexa máis fundamental bit tamaño, aínda non considerados útiles:

• Elliptic Curve Prime 521 bits - P-521

Gustaríame afirmar que as curvas de Koblitz debe evitarse, en calquera tamaño de clave (163/283/409/571), como eles non ten garantía suficiente na actividade analítica Crypto e eficaz son:

• Non forma parte da NSA selección cifrado Suite-B
• Non forma parte do ECC selección Brainpool
• Non forma parte da selección ANSI X9.62
• Non forma parte do OpenPGP selección extensión ECC
• Non forma parte da extensión do Kerberos para a selección de cóbado ECC

Convida o lector a seguir paga a miña análise para entender os fundamentos que poderían ser entendidas, aínda sen coñecemento técnico profundo, pero polo menos cunha boa base tecnolóxica a algúns pouco básico de cifrado.

 Aquí imos nós coa análise

O meu obxectivo é facer unha análise sobre o que / como o científico aberto e elixir un sistema de cifrado de seguridade comunidade ECC para uso en protocolos de seguridade e as normas establecidas polo IETF RFC (os que definen patróns de internet dunha forma aberta e peer-reviewed).

Continuación un conxunto de RFC Introducing ECC no sistema existente que son analizadas para entender o que é mellor usar eo que é mellor para eliminar:

• RFC5639 : ECC Brainpool defecto Curves & Xeración da curva
• RFC4869 : NSA Suite B criptográficas Suite para IPsec
• RFC5430 : NSA Suite B perfil para Transport Layer Security (TLS)
• RFC5008 : NSA Suite B en en Secure / Multipurpose Internet Mail Extensions (S / MIME)
• RFC3766 : Puntos fortes determinante para chaves públicas utilizadas para o intercambio de claves simétricas
• RFC5349 : Curve Cryptography (ECC) Elliptic Soporte para cifrado de clave pública para autenticación en Kerberos (PKINIT)
• RFC4492 : Elliptic Curve Cryptography (ECC) Cipher Suite Transport Layer Security (TLS)
• ZRTP cifrado de voz por Philip Zimmermann ECC curva
• ECC en OpenPGP (draft d balsa-jivsov-OpenPGP-ECC-06 )
• ECC Curves seleccionados por Microsoft para smartcard Kerberos sesión

Usaremos a escolla feita polo científico establecer protocolos de seguridade de internet para facer parte da nosa avaliación.
Ademais, debe ser entendido que a selección Curve vén de diversas autoridades que fixeron a súa propia selección de curvas, a fin de contar coa industria o que usar eo que saltar:

• US NIST (US National Institute of Standards) with 186-2 (recently superseded in 2009 by the new 186-3 )
• US ANSI (American National Standard Institute) with X9.62
• US NSA (National Security Agency) Suite-B Cryptography for TOP SECRET information exchange
• International SACG (Standards for efficient cryptography group) with Recommended Elliptic Curve Domain Parameters
• German ECC Brainpool withECC Brainpool with their Strict Security Requirements
• ECC Interoperability Forum composed by Certicom, Microsoft, Redhat, Sun, NSA

We will use the choice made by scientist defining security requirements in the standardization agencies to make part of our evaluation.
Additionally, something that most people does not know, but that it's extremely relevant to our analysis, is that there are different kind of ECC curve cryptography and their “size” it's different depending on the kind of curve:

• ECC Curves over Prime Field (often referred as Elliptic Curve and represented by P-keysize )
• ECC Curves over Binary Field (often referred as Koblitz Curve and represented by K-keysize )

Given a security strength equivalence the Elliptic Curve and the Kobliz Curve have different key size, for example when we read ECC 571 we are referring to Koblitz Curve with an equivalent strength to ECC 521 Prime curve.

A comparison of strength between Elliptic Curves and Kotbliz Curves is reported below (from Mikey ECC internet Draft ):

| Koblitz | ECC | DH/DSA/RSA
| 163 | 192 | 1024
| 283 | 256 | 3072
| 409 | 384 | 7680
| 571 | 521 | 15360

Below there's a comparison of all selected curves by all the various entities and their respective name (from IETF RFC4492 for ECC usage for TLS ) :

Curve names chosen by different standards organizations
------------+---------------+-------------
SECG | ANSI X9.62 | NIST
------------+---------------+-------------
sect163k1 | | NIST K-163
sect163r1 | |
sect163r2 | | NIST B-163
sect193r1 | |
sect193r2 | |
sect233k1 | | NIST K-233
sect233r1 | | NIST B-233
sect239k1 | |
sect283k1 | | NIST K-283
sect283r1 | | NIST B-283
sect409k1 | | NIST K-409
sect409r1 | | NIST B-409
sect571k1 | | NIST K-571
sect571r1 | | NIST B-571
secp160k1 | |
secp160r1 | |
secp160r2 | |
secp192k1 | |
secp192r1 | prime192v1 | NIST P-192
secp224k1 | |
secp224r1 | | NIST P-224
secp256k1 | |
secp256r1 | prime256v1 | NIST P-256
secp384r1 | | NIST P-384
secp521r1 | | NIST P-521
------------+---------------+-------------

What immediately appear is that there are only two curves selected by all authorities, and that there is a general dumping of koblitz curves by ANSI.The only commonly agreed among the 3 authorities are the following two ECC curve:

• secp192r1 / prime192v1 / NIST P-192
• secp256r1 / prime256v1 / NIST P-256

Of those selection of ECC curve for TLS the RFC5430 skipped completely koblitz curves and selected for usage only:

• P-256, P-384, P-521

The ECC Brainpool skipped completely Koblitz curves and selected for usage the following ECC Curves:

• P-160, P-192, P-224, P-256, P-320, P-384, P-512 ( that's the only particular because it's not P-521 but P-512, the only key-size referred by ECC brainpool. Tnx Ian Simons from Athena SCS )

The OpenPGP internet draft for ECC usage in PGP d raft-jivsov-openpgp-ecc-06 skipped completely Koblitz curves and selected the following ECC curves

• P-256, P-384, P-521

The Kerberos protocol extension for ECC use, defined in RFC5349 and defined by Microsoft for smartcard logon skipped completely Koblitz curves and selected the following ECC curves:

• P-256, P-384, P-521

So, sounds clear that the right selection of ECC is for P-256, P-384 and P-521 while the Koblitz curve have been skipped for Top Secret use and for any security sensitive protocol (IPSec, OpenPGP, ZRTP, Kerberos, SSL/TLS).

I have done this analysis following a discussion i had regarding certain voice encryption products, all based on custom and proprietary protocols, that are all using Elliptic Curve Diffie Hellman 571 bit / ECDH 571 / 571-bit ECDH / Koblitz 571 bits .
All them are using the K-571 that, as described before, has been removed from all security sensitive environment and protocols and being myself a designer of voice encryption stuff i think that their cryptographic choice is absolutely not the best security choice.
Probably it has been done just for marketing purpose, because K-571 (Koblitz curve) seems stronger than P-521 (Elliptic curve based on Prime number). If you have “more bit” your marketing guys can claim to be “more secure”. Koblitz elliptic curve are faster than the top secret enabled prime elliptic curve and so give the product manager a chance to provide “more bit” in it's own product while keeping the key exchange fast.

It's a matter of philosophical choice.

I prefer to follow the trend of scientific community with the humility of not to considering myself a cryptographic expert, knowledgable more than the overall security and scientific community itself.

I prefer instead to use only algorithms that are approved for use in highly sensitive environments (top secret classification), that have been selected by all the authorities and working group analyzing encryption algorithms existing out-there and that represent the choice of almost all standard security protocols (IPSec, OpenPGP, ZRTP, Kerberos, SSL/TLS, etc).
I prefer to count the amount of brains working on the crypto i use, that check that's really secure, that evaluate whether there's some weakness.

The number of brais working on Crypto widely diffused are of order of magnitude more than the number of brains working on crypto used by just few people (like Koblitz curve).
So i am not demonizing who use ECDH 571 using Koblitz Curve, but for sure i can affirm that they did not taken the best choice in terms of security and that any security professionals doing a security benchmarking would consider the fact that Elliptic Curve Diffie Hellman 571 bit done with Koblitz Curve is not widely diffused, it's dumped from standard security protocols and it's not certified for top secret use.