Comments (11)
Hey @cbluth ! and thanks for the issue.
In golang the curve25519 clamping is done during the scalar multiplication: https://github.com/golang/crypto/blob/70a84ac30bf957c7df57edd1935d2081871515e1/curve25519/curve25519_generic.go#L783
which might indeed contrast with how other implementations do it.
re-visiting this code I see one more issue, the API says generate keypair, but what type of keypair? We should correctly name functions and types to reflect that these are key exchanges keypairs
Would you be interested in submitting a PR to fix this key generation (so that other implementations that do not do the clamping during scalar multiplication are not affected) and potentially the naming problem?
from disco.
btw I see that libsodium also doesn't do the clamping during generation. @jedisct1 is there a reason and should we not do it for disco too?
from disco.
another thing is that since we use ristretto for signatures, we could also potentially just use that for key exchanges. But that's not in the noise specification... (cc @trevp)
from disco.
In libsodium, clamping is done during generation. crypto_scalarmult_base()
is where it happens, right after the line you referenced.
from disco.
If I understand correctly, the secret key is passed as a const to this function and is thus clamped temporarily to produce the public key.
I'm guessing you clamp it temporarily again when you perform scalarmult without the base :o and my worry is that not every implementation does that
from disco.
But the secret key, as returned by the key generation function, is not clamped if this is what you mean.
Mainly because we want to always do it before a scalar multiplication, in case the secret was not generated using the dedicated function. So, this avoids doing it twice.
This also prevents bits from being lost if the secret is hashed with a bunch of other data.
from disco.
NaCl/TweetNaCl also don't returned clamped scalars. Some implementations may do it, but clamping only before a multiplicatiton is probably the most common pattern.
from disco.
I'm guessing you clamp it temporarily again when you perform scalarmult without the base.
Yes, this is obviously also done when using a non-fixed base.
from disco.
Clamping not being done by the scalarmult function for an arbitrary base would delegate the responsibility to the application, which is usually what we want to avoid.
Clamping being done in scalarmul
and not by scalarmult_base
would be inconsistent.
So I guess most implementation are doing it unconditionally in both functions anyway. If not... they probably should.
from disco.
OK I see, thanks for chiming in @jedisct1 :)
So I guess I wouldn't be opposed to do it at generation (even if it's redundant), like this is we export the private key we won't have interop issues with an implementation that does not do the clamping during scalar mult.
from disco.
Would you be interested in submitting a PR to fix this key generation (so that other implementations that do not do the clamping during scalar multiplication are not affected) and potentially the naming problem?
i have a branch here with the renamed functions and types: https://github.com/mimoo/disco/compare/master...cbluth:fix/keypair_naming?expand=1
^ how does it look? im new to golang and crypto.
(so that other implementations that do not do the clamping during scalar multiplication are not affected)
i dont quite understand what you mean by this, would my current changes fix this too?
from disco.
Related Issues (20)
- Implement in load balancers and reverse proxies
- Document non-PKI ways of using Disco
- Initialize should take []byte for remote keys
- signing keys and Diffie-Hellman keys should be different
- encryptWithAd doesn't care about additional data
- clear secrets as soon as possible
- Security Issues and Breaking Changes Tracker
- Website has no HTTPS (redirect) HOT 1
- Create a merge between Noise and the Disco spec
- need hybrid encryption API
- main website
- balloon hashing for password hashing + password-based KDF
- story around signatures in disco HOT 1
- Christmas Wish: Retrofitting Disco to other sponge constructions HOT 5
- address go report findings
- License clarification HOT 10
- move website to a different repo
- "go test" failed HOT 2
- Disco the library needs a spec
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from disco.