Cryptology ePrint Archive: Report 2018/298

In search of CurveSwap: Measuring elliptic curve implementations in the wild

Luke Valenta and Nick Sullivan and Antonio Sanso and Nadia Heninger

Abstract: We survey elliptic curve implementations from several vantage points. We perform internet-wide scans for TLS on a large number of ports, as well as SSH and IPsec to measure elliptic curve support and implementation behaviors, and collect passive measurements of client curve support for TLS. We also perform active measurements to estimate server vulnerability to known attacks against elliptic curve implementations, including support for weak curves, invalid curve attacks, and curve twist attacks. We estimate that 0.77% of HTTPS hosts, 0.04% of SSH hosts, and 4.04% of IKEv2 hosts that support elliptic curves do not perform curve validity checks as specified in elliptic curve standards. We describe how such vulnerabilities could be used to construct an elliptic curve parameter downgrade attack called CurveSwap for TLS, and observe that there do not appear to be combinations of weak behaviors we examined enabling a feasible CurveSwap attack in the wild. We also analyze source code for elliptic curve implementations, and find that a number of libraries fail to perform point validation for JSON Web Encryption, and find a flaw in the Java and NSS multiplication algorithms.

Category / Keywords: cryptographic protocols / elliptic curve cryptography, invalid curve attack, curveswap

Original Publication (in the same form): EuroS&P 2018

Date: received 29 Mar 2018, last revised 29 Mar 2018

Contact author: lukev at seas upenn edu

Available format(s): PDF | BibTeX Citation

Version: 20180329:224851 (All versions of this report)

Short URL: ia.cr/2018/298


[ Cryptology ePrint archive ]