diff options
| -rw-r--r-- | README.md | 4 | ||||
| -rw-r--r-- | docs/CURVES.md | 6 | ||||
| -rw-r--r-- | docs/TESTS.md | 15 |
3 files changed, 23 insertions, 2 deletions
@@ -28,7 +28,6 @@ Following operations are tested: - Setting of custom curve and KeyPair generation - Generation of shared secret via ECDH - Signature via ECDSA -- Behavior of card when invalid curves/points are provided (should fail) See `java -jar ECTesterReader.jar -h` for more. @@ -39,6 +38,9 @@ See `java -jar ECTesterReader.jar -h` for more. -t,--test <test_suite> Test ECC support. [test_suite]: - default: - invalid: + - twist: + - degenerate: + - cofactor: - wrong: - composite: - test-vectors: diff --git a/docs/CURVES.md b/docs/CURVES.md index a815c5c..a0454a3 100644 --- a/docs/CURVES.md +++ b/docs/CURVES.md @@ -62,6 +62,12 @@ These points can be used to attack some implementations. Generated using [ecgen](https://github.com/J08nY/ecgen). +### degenerate +Contains pre-generated points on the line `Y: x = 0`. These points are constructed from elements of prime +order in the multiplicative group F_p given a curve over it. + +Generate manually using [PARI/GP](http://pari.math.u-bordeaux.fr/). + ### cofactor Contains curves that are composite order, with points not on the subgroup generated by the generator. diff --git a/docs/TESTS.md b/docs/TESTS.md index d2eb500..bd70206 100644 --- a/docs/TESTS.md +++ b/docs/TESTS.md @@ -6,9 +6,10 @@ - `composite` - `invalid` - `twist` + - `degenerate` - `cofactor` -**NOTE: The `wrong`, `composite`, `invalid`,`twist` and `cofactor` test suites caused temporary/permanent DoS of some cards. These test suites prompt you for +**NOTE: The `wrong`, `composite`, `invalid`,`twist`, `cofactor` and `degenerate` test suites caused temporary/permanent DoS of some cards. These test suites prompt you for confirmation before running, be cautious.** ## Default @@ -103,6 +104,18 @@ For example: java -jar ECTester.jar -t twist ``` +## Degenerate +Tests using known named curves froms several categories(SECG/NIST) against pre-generated points on the degenerate line +`Y: x = 0`. ECDH should fail, a success here might mean the card does not check that the point lies on the correct curve +and uses a curve model vulnerable to such degenerate points. + +See [Degenerate Curve Attachs - Extending Invalid Curve Attacks to Edwards Curves and Other Models](https://eprint.iacr.org/2015/1233.pdf) for more information. + +For example: +```bash +java -jar ECTester.jar -t degenerate +``` + ## Cofactor Tests whether the card correctly rejects points that lie on the curve but not on the subgroup generated by the specified generator during ECDH. |