Tag: p-384

Let's Encrypt 簽發新的 Intermediate CA

Let's Encrypt 宣佈簽發新的 Intermediate CA：「New Intermediate Certificates」。

這次用 ISRG Root X1 簽了很多東西出來：

On Wednesday, March 13, 2024, Let’s Encrypt generated 10 new Intermediate CA Key Pairs, and issued 15 new Intermediate CA Certificates containing the new public keys.

ISRG Root X1 簽了五組 2048-bit RSA 的 intermediate CA，被叫做 R10～R14：

We created 5 new 2048-bit RSA intermediate certificates named in sequence from R10 through R14. These are issued by ISRG Root X1. You can think of them as direct replacements for our existing R3 and R4 intermediates.

另外 ISRG Root X1 也簽出五組 P-384 ECDSA 的 intermediate CA，被叫做 E5～E9；另外 ISRG Root X2 也簽了 E5～E9：

We also created 5 new P-384 ECDSA intermediate certificates named in sequence from E5 through E9. Each of these is represented by two certificates: one issued by ISRG Root X2 (exactly like our existing E1 and E2), and one issued (or cross-signed) by ISRG Root X1.

所以總共是產生了 10 組 intermediate certificate，然後簽了 15 組 intermediate CA 出來。

另外這邊有個比較特別的是 ISRG Root X1 (RSA 4096) 也簽了 ISRG Root X2 (ECDSA P-384)，理論上 ISRG Root X2 這組後續應該也會開始放到各家的 root store 裡面...

用官方的圖可以說明這些關係：

目前還沒上線，先簽出來並且公告，後續才會切換過去。

另外在紋章裡面提到了 app 應該避免對 intermediate certificate 鎖定 (key pinning)：

We are very hopeful that these steps will prevent intermediate key pinning altogether, and help the WebPKI remain agile moving forward.

Intermediate CA 在安全理由上是需要定時更換的，真的要做的話，應該是對 Root CA 做比較好。

NIST P-curve 的 Seed Bounty Program

Filippo Valsorda 發起了 seed bounty program，針對 NIST P-curve 裡 seed 的部分尋找 SHA-1 的 pre-image：「Announcing the $12k NIST Elliptic Curves Seeds Bounty」。

先講一下這次的 bounty program，希望找出下面這些 SHA-1 的 pre-image input (也就是找出 input，使得 SHA1(input) 會等於下面的東西)：

3045AE6FC8422F64ED579528D38120EAE12196D5
BD71344799D5C7FCDC45B59FA3B9AB8F6A948BC5
C49D360886E704936A6678E1139D26B7819F7E90
A335926AA319A27A1D00896A6773A4827ACDAC73
D09E8800291CB85396CC6717393284AAA0DA64BA

金額是 US$12288，但是要五個都找到。

話說在寫這篇時，查資料發現 P-384 有獨立條目，但 P-256 與 P-521 都是重導指到 Elliptic-curve cryptography 這個條目，但 P-384 看起來也沒什麼特別的，不知道當初編輯的人是怎麼想的...

回來原來的問題，要從一些背景開始講，橢圓曲線的表示法有多種，像是：

y^2 = x^3 + ax + b (Weierstrass form) y^2 = x^3 + ax^2 + bx (Montgomery form)

而這些常數 a 與 b 的選擇會影響到計算速度，所以通常會挑過，但畢竟是密碼學用的東西，挑的過程如果都不解釋的話，會讓人懷疑是不是挑一個有後門的數字，尤其 NIST (NSA) 後來被證實在 Dual_EC_DRBG 裡面埋後門的醜聞，大家對於 NIST 選擇或是設計的密碼系統都有很多疑慮。

舉個例子來說，2005 年時 djb 發明了 Curve25519 (論文「Curve25519: new Diffie-Hellman speed records」則是記錄 2006)，選擇的橢圓曲線是：

y^2 = x^3 + 486662x^2 + x

他就有提到這邊的 486662 是怎麼來的：他先在前一個段落說明，這邊數字如果挑的不好的話，會有哪些攻擊可以用，接下來把最小的三個值列出來，然後說明原因：

To protect against various attacks discussed in Section 3, I rejected choices of A whose curve and twist orders were not {4 · prime, 8 · prime}; here 4, 8 are minimal since p ∈ 1+4Z. The smallest positive choices for A are 358990, 464586, and 486662. I rejected A = 358990 because one of its primes is slightly smaller than 2^252, raising the question of how standards and implementations should handle the theoretical possibility of a user’s secret key matching the prime; discussing this question is more difficult than switching to another A. I rejected 464586 for the same reason. So I ended up with A = 486662.

而 P-192、P-224、P-256、P-384 與 P-521 的值都很怪，這是十六進位的值，在正式的文件或是正式的說明上都沒有解釋，屬於「magic number」：

3045AE6FC8422F64ED579528D38120EAE12196D5 # NIST P-192, ANSI prime192v1
BD71344799D5C7FCDC45B59FA3B9AB8F6A948BC5 # NIST P-224
C49D360886E704936A6678E1139D26B7819F7E90 # NIST P-256, ANSI prime256v1
A335926AA319A27A1D00896A6773A4827ACDAC73 # NIST P-384
D09E8800291CB85396CC6717393284AAA0DA64BA # NIST P-521

依照 Steve Weis 說，這些值當初是 Jerry Solinas 是隨便抓個字串，再用 SHA-1 生出來的：

Apparently, they were provided by the NSA, and generated by Jerry Solinas in 1997. He allegedly generated them by hashing, presumably with SHA-1, some English sentences that he later forgot.

這是 Steve Weis 的敘述，出自「How were the NIST ECDSA curve parameters generated?」：

[Jerry] told me that he used a seed that was something like:
SEED = SHA1("Jerry deserves a raise.")
After he did the work, his machine was replaced or upgraded, and the actual phrase that he used was lost. When the controversy first came up, Jerry tried every phrase that he could think of that was similar to this, but none matched.

如果可以證實當初的字串，那麼 NIST 在裡面埋後門的疑慮會再降低一些，這就是這次發起 bounty program 的原因。