Bringing Elliptic Curve Cryptography into the Mainstream

34
Elliptic Curve Cryptography Bringing it to the mainstream Stanford Security Lunch November 4, 2015 Nick Sullivan @grittygrease nick@cloudflare.com

Transcript of Bringing Elliptic Curve Cryptography into the Mainstream

Page 1: Bringing Elliptic Curve Cryptography into the Mainstream

Elliptic Curve CryptographyBringing it to the mainstream

Stanford Security Lunch November 4, 2015

Nick Sullivan @grittygrease

[email protected]

mailto:[email protected]
Page 2: Bringing Elliptic Curve Cryptography into the Mainstream
Page 3: Bringing Elliptic Curve Cryptography into the Mainstream
Page 4: Bringing Elliptic Curve Cryptography into the Mainstream

DNS

Page 5: Bringing Elliptic Curve Cryptography into the Mainstream

HTTP

Page 6: Bringing Elliptic Curve Cryptography into the Mainstream

HTTPSThe “S” stands for TLS

Page 7: Bringing Elliptic Curve Cryptography into the Mainstream
Page 8: Bringing Elliptic Curve Cryptography into the Mainstream
Page 9: Bringing Elliptic Curve Cryptography into the Mainstream

HTTPS Adoption (2013)• 2,545,693 valid RSA 2048-bit certificates

Analysis of the HTTPS Certificate Ecosystem, Durumeric, Kasten, Bailey, Halderman (2013)

• Zero valid ECDSA certificates

9

Page 10: Bringing Elliptic Curve Cryptography into the Mainstream

CloudFlare Reverse Proxy

10

Page 11: Bringing Elliptic Curve Cryptography into the Mainstream

11

CACloudFlare

CloudFlare Edge DNS

CSR

TXT?

Proof

TXT?

Proof

Certificate

Proof

Page 12: Bringing Elliptic Curve Cryptography into the Mainstream

Goal

Enable HTTPS by default for ~2 million free

customers12

Page 13: Bringing Elliptic Curve Cryptography into the Mainstream

Issue: Scale

~30 Trillion Requests/Day

13

Page 14: Bringing Elliptic Curve Cryptography into the Mainstream

What is expensive in TLS?• Private key Operations

• Bulk encryption

14

Page 15: Bringing Elliptic Curve Cryptography into the Mainstream

Bulk Encryption• Basically free with modern Intel processors

• AES-GCM on Haswell is ~1 cycle per byte

15

Page 16: Bringing Elliptic Curve Cryptography into the Mainstream

Private Key Operations• Orders of magnitude slower than symmetric crypto

• RSA ~2,000,000 cycles per signature on Haswell

• ~500 Quadrillion Cycles/Day

16

Page 17: Bringing Elliptic Curve Cryptography into the Mainstream

We can do better• Session resumption (~33%)

17

Page 18: Bringing Elliptic Curve Cryptography into the Mainstream

ECDSAElliptic Curve Digital Signature Algorithm

Page 19: Bringing Elliptic Curve Cryptography into the Mainstream

ECDSA• Digital signature algorithm based on elliptic curve crypto

• Widely studied, no sub-exponential discrete logarithm

• Standardized NIST Curves (P256, P384, P521)

• NSA Suite B (Secret and Top Secret)

19

Page 20: Bringing Elliptic Curve Cryptography into the Mainstream

EQUATIONS!!!

20

Page 21: Bringing Elliptic Curve Cryptography into the Mainstream

ECDSA Advantages• Smaller keys (256bit EC ~ 3072bit RSA)

• Faster signatures (~800K vs 2M)

• Vlad Krasnov improved to ~375K by using x86_64 asm

• Merged into OpenSSL, Golang

• Saves 300 Quadrillion Cycles/Day (given 100% HTTPS)

21

Page 22: Bringing Elliptic Curve Cryptography into the Mainstream

ECDSA Downsides• Slower signature verification

• Less ubiquitous

• Roots were added in

• Some systems don’t support ECDSA (Android 2, Windows XP)

• Patent encumbrances

• Not quantum-safe: subject to Shor’s algorithm

22

Page 23: Bringing Elliptic Curve Cryptography into the Mainstream

Universal SSL• Free ECDSA certificates for all customers

• HTTPS enabled by default

• Total number of HTTPS sites is up by over 2 million

• SNI-only so scans undercount

23

Page 24: Bringing Elliptic Curve Cryptography into the Mainstream

What about DNS?

24

Page 25: Bringing Elliptic Curve Cryptography into the Mainstream

Authoritative Servers

25

Page 26: Bringing Elliptic Curve Cryptography into the Mainstream

Cache Poisoning (Kaminsky’s attack)

26

Resolver AuthoritativeServer

Q: what is the IP address of cloudflare.com

A: 198.41.213.157

A: 6

.6.6

.6

A: 6

.6.6

.6 A: 6.6.6.6

A: 6.6.6.6A: 6.6.6.6

A: 6.6.6.6A: 6.6.6.6

http://cloudflare.com
Page 27: Bringing Elliptic Curve Cryptography into the Mainstream

Man-in-the-middle

27

ResolverAuthoritative

Server

Q: what is the IP address of cloudflare.com

A: 198.41.213.157A: 6.6.6.6

http://cloudflare.com
Page 28: Bringing Elliptic Curve Cryptography into the Mainstream

DNSSEC signature verification

28

Aexample.com. A RRSIG

example.com.DNSKEY KSKexample.com.

DNSKEY KSK .

Verisign

Authoritative(i.e. CloudFlare)

ICANN

DSexample.com.

DScom.

Root Key

DNSKEY ZSKexample.com.

DNSKEY RRSIGexample.com.

DS RRSIGcom.

DNSKEY KSKcom.

DNSKEY ZSKcom.

DNSKEY RRSIGcom.

A RRSIG.

DNSKEY ZSK.

DNSKEY RRSIG.

http://example.com
Page 29: Bringing Elliptic Curve Cryptography into the Mainstream

29

Page 30: Bringing Elliptic Curve Cryptography into the Mainstream

Solution: DNSSEC (done right)Digital signatures in the DNS

Live-signed answers

Elliptic curve keys

30

Page 31: Bringing Elliptic Curve Cryptography into the Mainstream

Solution: DNSSEC (done right)cloudflare.net. 300 IN A 104.20.36.89

cloudflare.net. 300 IN A 104.20.37.89

cloudflare.net. 300 IN RRSIG A 13 2 300 20151105181354 20151103161354 35273 cloudflare.net. 1lj7NV/tLbTWAk/HeiU4UvxwTDPG8nXGEn408Rm7HELyL0HE3QRQTMha /Y0yTIAJWvQFKwGm2lg61Gpf9uy7uQ==

ietf.org. 1800 IN A 4.31.198.44

ietf.org. 1800 IN RRSIG A 5 2 1800 20161012164049 20151013154322 40452 ietf.org. DlaOfMqEIkbTBY8Rv8WJf2MqXBzT64sUr+Ms5zEfV4IIdKhiQoQqU8vH Ga+PcZak5DzfXwXuklriXPI7jN5Zqk/UnTsX62on0SQft/YkgAogMdZI U5znPsgkq+gX/BA2AkRpBOEBDiPS8sRgJb4r38kZ05BNLTvlweg3hIcX m1JHfbXuyAE4C6bRmD/h5erxvO6Q2UA2EFWHjcrIAAhmLRqHxeq8uhCJ AZMSJyTuJxB+6z+59v4/QxP+z3NnBdzxcTea1aUVYG/zbqiHkNpgRzrN 708UrrqkUwWDodrOYoHndfYoWqI61ifvBkUref0cn0IKWOolfHMsCjdl y6BdTA==

31

Page 32: Bringing Elliptic Curve Cryptography into the Mainstream

Issues addressedFix zone enumeration with live signing

Fix live signing with ECDSA — in the Go language

Vlad performance improvements

Amplification-neutral

32

Page 33: Bringing Elliptic Curve Cryptography into the Mainstream

ECDSA - Miscellaneous• Randomness breaks ECDSA

• Fixed by RFC 6979

• Patent issues • ECDSA is not supported by Red Hat

• A Riddle Wrapped in an Enigma • Koblitz & Menezes paper on Suite B

• Are the NIST curves safe?33

Page 34: Bringing Elliptic Curve Cryptography into the Mainstream

Elliptic Curve CryptographyBringing it to the mainstream

Nick Sullivan @grittygrease

[email protected]

mailto:[email protected]

ECC - Elliptic Curve Cryptography

ECC - Elliptic Curve Cryptography

Elliptic Curve Cryptography An Introduction

Elliptic Curve Cryptography An Introduction

DEPLOYMENTS OF ELLIPTIC CURVE CRYPTOGRAPHY Outline

DEPLOYMENTS OF ELLIPTIC CURVE CRYPTOGRAPHY Outline

What is Elliptic Curve Cryptography?

What is Elliptic Curve Cryptography?

Elliptic Curve Cryptography (ECCrinaldi.munir... · 2015. 3. 23. · 1. Andreas Steffen, Elliptic Curve Cryptography, ZürcherHochschuleWinterthur. 2. DebdeepMukhopadhyay , Elliptic

Elliptic Curve Cryptography (ECCrinaldi.munir... · 2015. 3. 23. · 1. Andreas Steffen, Elliptic Curve Cryptography, ZürcherHochschuleWinterthur. 2. DebdeepMukhopadhyay , Elliptic

Elliptic curves and applications to cryptography

Elliptic curves and applications to cryptography

Fast and compact elliptic-curve cryptography

Fast and compact elliptic-curve cryptography

COM5336 Cryptography Lecture 10 Elliptic Curve Cryptography

COM5336 Cryptography Lecture 10 Elliptic Curve Cryptography

Data Security Using Elliptic Curve Cryptography

Data Security Using Elliptic Curve Cryptography

Elliptic Curves and Elliptic Curve Cryptography

Elliptic Curves and Elliptic Curve Cryptography

Elliptic Curves in Cryptography

Elliptic Curves in Cryptography

Cryptography - Key Agreement and Key Transport Using Elliptic Curve Cryptography

Cryptography - Key Agreement and Key Transport Using Elliptic Curve Cryptography

The Advantages of Elliptic Curve Cryptography for … Advantages of Elliptic Curve Cryptography for Security 4999 1.2 Elliptic curve cryptography Since ECC is a public key cryptography,

The Advantages of Elliptic Curve Cryptography for … Advantages of Elliptic Curve Cryptography for Security 4999 1.2 Elliptic curve cryptography Since ECC is a public key cryptography,

Introduction to Elliptic Curve Cryptography

Introduction to Elliptic Curve Cryptography

Integrating Lamports OTP Scheme with Elliptic Curve ... · Elliptic Curve Cryptography Core Algorithm Elliptic curve cryptography (ECC) is an approach to public-key cryptography based

Integrating Lamports OTP Scheme with Elliptic Curve ... · Elliptic Curve Cryptography Core Algorithm Elliptic curve cryptography (ECC) is an approach to public-key cryptography based

Guide to Elliptic Curve Cryptography - Lagout.org

Guide to Elliptic Curve Cryptography - Lagout.org

Elliptic Curve Cryptography based Threshold Cryptography (ECC- TC)

Elliptic Curve Cryptography based Threshold Cryptography (ECC- TC)

Elliptic Curve Cryptography: Arithmetic behind

Elliptic Curve Cryptography: Arithmetic behind

Hardware Acceleration of Elliptic Curve Cryptography

Hardware Acceleration of Elliptic Curve Cryptography

Elliptic Curve Cryptography on PocketPCs

Elliptic Curve Cryptography on PocketPCs