summaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
authorJ08nY2018-02-04 19:20:08 +0100
committerJ08nY2018-02-04 19:20:08 +0100
commit370f65c33992f71b7d21296f0fe44fa1380d4541 (patch)
tree283a69cdf7f11c303fabd5be2f03753d39356db6 /docs
parent18bfe2cdac09ff9faed5c92971a7e63d56570ac2 (diff)
downloadECTester-370f65c33992f71b7d21296f0fe44fa1380d4541.tar.gz
ECTester-370f65c33992f71b7d21296f0fe44fa1380d4541.tar.zst
ECTester-370f65c33992f71b7d21296f0fe44fa1380d4541.zip
Diffstat (limited to 'docs')
-rw-r--r--docs/CURVES.md44
-rw-r--r--docs/LIBS.md4
-rw-r--r--docs/TESTS.md68
3 files changed, 75 insertions, 41 deletions
diff --git a/docs/CURVES.md b/docs/CURVES.md
index 4a80d49..a04e82f 100644
--- a/docs/CURVES.md
+++ b/docs/CURVES.md
@@ -1,47 +1,63 @@
# Curves
+ECTester contains a collection of elliptic curve/point parameters, these parameters either come from standards or
+were generated manually or using [ecgen](https://github.com/J08nY/ecgen).
-## SECG
+These parameters can be found in the [cz.crcs.ectester.data](/src/cz/ectester/data/) package.
+
+
+## Standard
+
+### SECG
SEC 2: Recommended Elliptic Curve Domain Parameters version 2.0 January 27, 2010
[Source](http://www.secg.org/sec2-v2.pdf)
-## NIST
+### NIST
RECOMMENDED ELLIPTIC CURVES FOR FEDERAL GOVERNMENT USE July 1999
[Source](http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf)
-## x962
+### x962
ANSI X9.62 example curves.
-## Brainpool
+### Brainpool
ECC Brainpool Standard Curves and Curve Generation v. 1.0 19.10.2005
[Source](http://www.ecc-brainpool.org/download/Domain-parameters.pdf)
-## anssi
+### anssi
Agence nationale de la sécurité des systèmes d'information: Publication d'un paramétrage de courbe elliptique visant des applications de passeport électronique et de l'administration électronique française. 21 November 2011
-## GOST
+### GOST
GOST R 34.10-2001: RFC5832 curves.
[Source](https://tools.ietf.org/html/rfc5832)
-## anomalous
+
+## Generated
+
+### anomalous
These prime field curves have the same order as the field order, and are susceptible to attacks reducing ECDLP over a multiplicative group of the curve, to DLP over an additive group of the underlying field, which is easy (linear time).
Some of these are from Atsuko Miyaji's [paper](https://dspace.jaist.ac.jp/dspace/bitstream/10119/4464/1/73-61.pdf), others were generated using [ecgen](htps://github.com/J08nY/ecgen).
-## invalid
+### invalid
This category contains pre-generated invalid curves for a large subset of NIST, SECG and Brainpool curves. Invalid curves for a given curve, are short Weierstrass curves with all parameters equal to the given curve except the `b` parameter. These curves can be used to [attack some implementations](https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/09/14/main-full.pdf).
-Generated using [ecgen](https://github.com/J08nY/ecgen)
+Generated using [ecgen](https://github.com/J08nY/ecgen).
-## composite
+### composite
Contains curves of composite order, with small order points.
-Generated using [ecgen](https://github.com/J08nY/ecgen)
+Generated using [ecgen](https://github.com/J08nY/ecgen).
+
+### wrong
+Contains parameters that are not elliptic curves(over Fp and F2m), such as `p` parameter that is not prime or an irreducible polynomial that is not irreducible.
+
+Generated manually.
-## wrong
-Contains parameters that are not elliptic curves(over Fp and F2m), such as `p` parameter that is not prime, irreducible polynomial that is not irreducible and similar.
+### twist
+Contains pre-generated points on twists of known named curves from NIST, SECG.
+These points can be used to attack some implementations.
-Generated manually. \ No newline at end of file
+Generated using [ecgen](https://github.com/J08nY/ecgen). \ No newline at end of file
diff --git a/docs/LIBS.md b/docs/LIBS.md
index 4fac57b..1f1f92c 100644
--- a/docs/LIBS.md
+++ b/docs/LIBS.md
@@ -1,15 +1,13 @@
-# Libraries with ECC
+# Libraries with ECC support
Libraries with at least some ECC support:
- [Crypto++](https://cryptopp.com/)
- [libgcrypt](https://www.gnupg.org/related_software/libgcrypt/)
-
- [mbedTLS](https://tls.mbed.org/)
- [Nettle](http://www.lysator.liu.se/~nisse/nettle/)
- [OpenSSL](https://www.openssl.org/)
- [OpenSSL (FIPS mode)](https://www.openssl.org/docs/fipsnotes.html)
-
- [Microsoft CNG](https://msdn.microsoft.com/en-us/library/windows/desktop/aa376210(v=vs.85).aspx)
- [Microsoft .NET crypto](https://docs.microsoft.com/en-us/dotnet/standard/security/cryptography-model)
diff --git a/docs/TESTS.md b/docs/TESTS.md
index c4f38dc..72c328d 100644
--- a/docs/TESTS.md
+++ b/docs/TESTS.md
@@ -1,12 +1,13 @@
-# Tests
+# Test suites
- `default`
- `test-vectors`
- `wrong`
- `composite`
- `invalid`
+ - `twist`
-**NOTE: The `wrong`, `composite` and `invalid` test suites caused temporary DoS of some cards. These test suites prompt you for
+**NOTE: The `wrong`, `composite`, `invalid` and `twist` test suites caused temporary/permanent DoS of some cards. These test suites prompt you for
confirmation before running, be cautious.**
## Default
@@ -18,14 +19,10 @@ This test suite is run if no argument is provided to `-t / --test`.
For example:
```bash
-java -jar ECTester.jar -a -fp -t
+java -jar ECTester.jar -t
```
-tests all(`-a`), prime field(`-fp`), using the default test suite.
+tests prime field and binary field curves, using the default test suite.
-```bash
-java -jar ECTester.jar-a -f2m -t
-```
-tests all(`-a`), binary field(`-f2m`), curves.
## Test-Vectors
Tests using known test vectors provided by NIST/SECG/Brainpool:
@@ -40,25 +37,33 @@ Tests using known test vectors provided by NIST/SECG/Brainpool:
For example:
```bash
-java -jar ECTester.jar -t test-vectors -nc nist -a -f2m
-```
-tests all(`-a`), binary field(`-f2m`) NIST curves for which test-vectors are provided. Although this test suite is better for general testing:
-```bash
-java -jar ECTester.jar -t test-vectors -a
+java -jar ECTester.jar -t test-vectors
```
+tests all curves for which test-vectors are provided.
+
+
## Wrong
-Tests using the default tests on a category of wrong curves. These curves are not really curves as they have:
+Tests on a category of wrong curves. These curves are not really curves as they have:
- non-prime field in the prime-field case
- reducible polynomial as the field polynomial in the binary case
+This test suite also does some additional tests with corrupting the field parameter:
+ - Fp:
+ - p = 0
+ - p = 1
+ - p = q^2; q prime
+ - p = q * s; q and s prime
+ - F2m:
+ - e1 = e2 = e3 = 0
+ - m < e1 < e2 < e3
+
+These tests should fail generally.
-These tests should fail generally. They are equivalent with `java -jar ECTester.jar -nc wrong -t`, the default tests over the `wrong` category
-of curves.
-
For example:
```bash
-java -jar ECTester.jar -t wrong -b 521 -fp
+java -jar ECTester.jar -t wrong
```
-tests a 521 bit(`-b`), prime-field(`-fp`) wrong curve.
+does all wrong curve tests.
+
## Composite
Tests using curves that don't have a prime order/nearly prime order.
@@ -67,16 +72,31 @@ by the applet. Operations over such curves are susceptible to small-subgroup att
For example:
```bash
-java -jar ECTester.jar -t composite -b 160 -fp
+java -jar ECTester.jar -t composite
```
+
## Invalid
-Tests using known named curves from several categories(SECG/NIST/Brainpool) against pregenerated *invalid* public keys.
-These tests should definitely fail, a success here implies the card is susceptible to invalid curve attacks.
+Tests using known named curves from several categories(SECG/NIST/Brainpool) against pre-generated *invalid* public keys.
+ECDH should definitely fail, a success here implies the card is susceptible to invalid curve attacks.
+See [Practical Invalid Curve Attacks on TLS-ECDH](https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/09/14/main-full.pdf) for more information.
For example:
```bash
-java -jar ECTester.jar -t invalid -nc nist -a -fp
+java -jar ECTester.jar -t invalid
```
-tests using all(`-a`), prime-field(`-fp`) NIST curves and pregenerated *invalid* public keys for these curves. \ No newline at end of file
+tests using all curves with pregenerated *invalid* public keys for these curves.
+
+
+## Twist
+Tests using known named curves froms several categories(SECG/NIST) against pre-generated points on twists of said curves.
+ECDH should fail, a success here implies the card is not twist secure, if a curve with an unsecure twist is used,
+the card might compute on the twist, if a point on the twist is supplied.
+
+See [SafeCurves on twist security](https://safecurves.cr.yp.to/twist.html) for more information.
+
+For example:
+```bash
+java -jar ECTester.jar -t twist
+``` \ No newline at end of file