Subject: [Webpush] Suggestion regarding curve validation in draft-ietf-webpush-encryption

From: Peter Beverloo <[email-masked]>
Date: Thu, 11 May 2017 19:57:21 +0100

Relaying for Quan Nguyen (cc'd):

      I would suggest adding a section about verifying peer's public key
      is on the private key's curve in ECDH protocol. Without this check,
      for the curve that they use P-256, it would allow attacker to
      extract the private key.

Thanks,
Peter

---

From: Martin Thomson <[email-masked]>
Date: Fri, 12 May 2017 10:26:29 +1000

Yeah, probably not a bad idea.  I originally assumed that this was
part of most libraries (NSS does this always), but since writing the
draft I've learned that not every library does this properly.

I've updated my private copy of the draft.  I've also checked that my
implementations of the draft aren't vulnerable (I only traced the
code, but it appears that they all end up in the openssl key import
code, which validates points:
https://github.com/openssl/openssl/blob/master/crypto/ec/ec_lib.c#L741).