diff options
| author | J08nY | 2018-02-04 19:20:08 +0100 |
|---|---|---|
| committer | J08nY | 2018-02-04 19:20:08 +0100 |
| commit | 370f65c33992f71b7d21296f0fe44fa1380d4541 (patch) | |
| tree | 283a69cdf7f11c303fabd5be2f03753d39356db6 /docs | |
| parent | 18bfe2cdac09ff9faed5c92971a7e63d56570ac2 (diff) | |
| download | ECTester-370f65c33992f71b7d21296f0fe44fa1380d4541.tar.gz ECTester-370f65c33992f71b7d21296f0fe44fa1380d4541.tar.zst ECTester-370f65c33992f71b7d21296f0fe44fa1380d4541.zip | |
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/CURVES.md | 44 | ||||
| -rw-r--r-- | docs/LIBS.md | 4 | ||||
| -rw-r--r-- | docs/TESTS.md | 68 |
3 files changed, 75 insertions, 41 deletions
diff --git a/docs/CURVES.md b/docs/CURVES.md index 4a80d49..a04e82f 100644 --- a/docs/CURVES.md +++ b/docs/CURVES.md @@ -1,47 +1,63 @@ # Curves +ECTester contains a collection of elliptic curve/point parameters, these parameters either come from standards or +were generated manually or using [ecgen](https://github.com/J08nY/ecgen). -## SECG +These parameters can be found in the [cz.crcs.ectester.data](/src/cz/ectester/data/) package. + + +## Standard + +### SECG SEC 2: Recommended Elliptic Curve Domain Parameters version 2.0 January 27, 2010 [Source](http://www.secg.org/sec2-v2.pdf) -## NIST +### NIST RECOMMENDED ELLIPTIC CURVES FOR FEDERAL GOVERNMENT USE July 1999 [Source](http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf) -## x962 +### x962 ANSI X9.62 example curves. -## Brainpool +### Brainpool ECC Brainpool Standard Curves and Curve Generation v. 1.0 19.10.2005 [Source](http://www.ecc-brainpool.org/download/Domain-parameters.pdf) -## anssi +### anssi Agence nationale de la sécurité des systèmes d'information: Publication d'un paramétrage de courbe elliptique visant des applications de passeport électronique et de l'administration électronique française. 21 November 2011 -## GOST +### GOST GOST R 34.10-2001: RFC5832 curves. [Source](https://tools.ietf.org/html/rfc5832) -## anomalous + +## Generated + +### anomalous These prime field curves have the same order as the field order, and are susceptible to attacks reducing ECDLP over a multiplicative group of the curve, to DLP over an additive group of the underlying field, which is easy (linear time). Some of these are from Atsuko Miyaji's [paper](https://dspace.jaist.ac.jp/dspace/bitstream/10119/4464/1/73-61.pdf), others were generated using [ecgen](htps://github.com/J08nY/ecgen). -## invalid +### invalid This category contains pre-generated invalid curves for a large subset of NIST, SECG and Brainpool curves. Invalid curves for a given curve, are short Weierstrass curves with all parameters equal to the given curve except the `b` parameter. These curves can be used to [attack some implementations](https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/09/14/main-full.pdf). -Generated using [ecgen](https://github.com/J08nY/ecgen) +Generated using [ecgen](https://github.com/J08nY/ecgen). -## composite +### composite Contains curves of composite order, with small order points. -Generated using [ecgen](https://github.com/J08nY/ecgen) +Generated using [ecgen](https://github.com/J08nY/ecgen). + +### wrong +Contains parameters that are not elliptic curves(over Fp and F2m), such as `p` parameter that is not prime or an irreducible polynomial that is not irreducible. + +Generated manually. -## wrong -Contains parameters that are not elliptic curves(over Fp and F2m), such as `p` parameter that is not prime, irreducible polynomial that is not irreducible and similar. +### twist +Contains pre-generated points on twists of known named curves from NIST, SECG. +These points can be used to attack some implementations. -Generated manually.
\ No newline at end of file +Generated using [ecgen](https://github.com/J08nY/ecgen).
\ No newline at end of file diff --git a/docs/LIBS.md b/docs/LIBS.md index 4fac57b..1f1f92c 100644 --- a/docs/LIBS.md +++ b/docs/LIBS.md @@ -1,15 +1,13 @@ -# Libraries with ECC +# Libraries with ECC support Libraries with at least some ECC support: - [Crypto++](https://cryptopp.com/) - [libgcrypt](https://www.gnupg.org/related_software/libgcrypt/) - - [mbedTLS](https://tls.mbed.org/) - [Nettle](http://www.lysator.liu.se/~nisse/nettle/) - [OpenSSL](https://www.openssl.org/) - [OpenSSL (FIPS mode)](https://www.openssl.org/docs/fipsnotes.html) - - [Microsoft CNG](https://msdn.microsoft.com/en-us/library/windows/desktop/aa376210(v=vs.85).aspx) - [Microsoft .NET crypto](https://docs.microsoft.com/en-us/dotnet/standard/security/cryptography-model) diff --git a/docs/TESTS.md b/docs/TESTS.md index c4f38dc..72c328d 100644 --- a/docs/TESTS.md +++ b/docs/TESTS.md @@ -1,12 +1,13 @@ -# Tests +# Test suites - `default` - `test-vectors` - `wrong` - `composite` - `invalid` + - `twist` -**NOTE: The `wrong`, `composite` and `invalid` test suites caused temporary DoS of some cards. These test suites prompt you for +**NOTE: The `wrong`, `composite`, `invalid` and `twist` test suites caused temporary/permanent DoS of some cards. These test suites prompt you for confirmation before running, be cautious.** ## Default @@ -18,14 +19,10 @@ This test suite is run if no argument is provided to `-t / --test`. For example: ```bash -java -jar ECTester.jar -a -fp -t +java -jar ECTester.jar -t ``` -tests all(`-a`), prime field(`-fp`), using the default test suite. +tests prime field and binary field curves, using the default test suite. -```bash -java -jar ECTester.jar-a -f2m -t -``` -tests all(`-a`), binary field(`-f2m`), curves. ## Test-Vectors Tests using known test vectors provided by NIST/SECG/Brainpool: @@ -40,25 +37,33 @@ Tests using known test vectors provided by NIST/SECG/Brainpool: For example: ```bash -java -jar ECTester.jar -t test-vectors -nc nist -a -f2m -``` -tests all(`-a`), binary field(`-f2m`) NIST curves for which test-vectors are provided. Although this test suite is better for general testing: -```bash -java -jar ECTester.jar -t test-vectors -a +java -jar ECTester.jar -t test-vectors ``` +tests all curves for which test-vectors are provided. + + ## Wrong -Tests using the default tests on a category of wrong curves. These curves are not really curves as they have: +Tests on a category of wrong curves. These curves are not really curves as they have: - non-prime field in the prime-field case - reducible polynomial as the field polynomial in the binary case +This test suite also does some additional tests with corrupting the field parameter: + - Fp: + - p = 0 + - p = 1 + - p = q^2; q prime + - p = q * s; q and s prime + - F2m: + - e1 = e2 = e3 = 0 + - m < e1 < e2 < e3 + +These tests should fail generally. -These tests should fail generally. They are equivalent with `java -jar ECTester.jar -nc wrong -t`, the default tests over the `wrong` category -of curves. - For example: ```bash -java -jar ECTester.jar -t wrong -b 521 -fp +java -jar ECTester.jar -t wrong ``` -tests a 521 bit(`-b`), prime-field(`-fp`) wrong curve. +does all wrong curve tests. + ## Composite Tests using curves that don't have a prime order/nearly prime order. @@ -67,16 +72,31 @@ by the applet. Operations over such curves are susceptible to small-subgroup att For example: ```bash -java -jar ECTester.jar -t composite -b 160 -fp +java -jar ECTester.jar -t composite ``` + ## Invalid -Tests using known named curves from several categories(SECG/NIST/Brainpool) against pregenerated *invalid* public keys. -These tests should definitely fail, a success here implies the card is susceptible to invalid curve attacks. +Tests using known named curves from several categories(SECG/NIST/Brainpool) against pre-generated *invalid* public keys. +ECDH should definitely fail, a success here implies the card is susceptible to invalid curve attacks. +See [Practical Invalid Curve Attacks on TLS-ECDH](https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/09/14/main-full.pdf) for more information. For example: ```bash -java -jar ECTester.jar -t invalid -nc nist -a -fp +java -jar ECTester.jar -t invalid ``` -tests using all(`-a`), prime-field(`-fp`) NIST curves and pregenerated *invalid* public keys for these curves.
\ No newline at end of file +tests using all curves with pregenerated *invalid* public keys for these curves. + + +## Twist +Tests using known named curves froms several categories(SECG/NIST) against pre-generated points on twists of said curves. +ECDH should fail, a success here implies the card is not twist secure, if a curve with an unsecure twist is used, +the card might compute on the twist, if a point on the twist is supplied. + +See [SafeCurves on twist security](https://safecurves.cr.yp.to/twist.html) for more information. + +For example: +```bash +java -jar ECTester.jar -t twist +```
\ No newline at end of file |
