4
$\begingroup$

I am working in a very bandwidth restricted environment, and we are looking to implement ECDSA digital signatures. Although they are no longer recommended, we might be looking to use curves that are not listed as supported by most libs, including OpenSSL: https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Supported_elliptic_curves

We are looking at curves such as secp112r2, secp128r1, sect131r1 and so on. This is not to discuss security of these, but their support.

In Cygwin, a huge load of curves is available, including the mentioned low-secutity curves. But in the URL these curves are not listed. Our team has observed that in some other OpenSSL sources (that are not through Cygwin), these curves are not supported. Are they no longer supported by OpenSSL, and if so - why are they available to me through Cygwin?

And by the way - I assume curve support is rather complicated, so that it is not possible to "import" a curve that is not supported in a given library.

$\endgroup$
  • 1
    $\begingroup$ So, the version openssl you use on cygwin supports more curves than the one you use elsewhere? Changelogs between the two version numbers might help you, but probably they have just been removed as insecure or possibly put behind a config option. I'm not sure this question is really on-topic here, however... $\endgroup$ – otus Jan 13 '16 at 9:44
  • $\begingroup$ If signature size is a problem, consider using BLS signatures which have half the size of ECDSA signatures. $\endgroup$ – CodesInChaos Jan 13 '16 at 12:01
  • 3
    $\begingroup$ Alternatively, you might want to consider whether a Message Authentication Code fits within your security requirements. With a MAC, the "signer" and the "verifier" share the same key (and so the "verifier" could "sign" if he wants); if that is not a problem for you (and I don't know enough about your situation to say), MACs use much less bandwidth than signatures. $\endgroup$ – poncho Jan 13 '16 at 13:56
2
$\begingroup$

I'm not sure, but I guess that two different openssl version or just builds could be done with or without support of Elliptic Curves with unsecure security levels.

Furthermore your curves have very low security level, and you shouldn't use them if security is a concern (and if it's not, you probably don't need ECDSA at all).

However, your assumption that "curve support is rather complicated" is wrong.

With libcrypto, the OpenSSL library, not the command line tool, you can use EC_GROUP_get_curve_GF to create your own elliptic curve. If you put in the parameters of those curves, you will be able to use them, with the library, even if the parameters are not encoded in OpenSSL.

$\endgroup$
2
$\begingroup$

That wikipedia article is about TLS, and lists separately only EC curves that have assigned numbers in TLS; for TLS all other curves fall under "arbitrary prime" or "arbitrary 2^m". OpenSSL supports for non-TLS operations including ECDSA quite a few curves not numbered for use in TLS, including the three you list. As requested, I do not comment on their insecurity ;-()

Since OpenSSL is open source people can change it. In particular RedHat until fairly recently built OpenSSL with all ECC removed, because of what they vaguely described as "legal" concerns. It was widely rumored, but AFAIK not confirmed, they meant the Certicom patents. Then they changed to include only P256 P384 -- the two SuiteB curves, possibly because NSA had a blanket license for anyone to use SuiteB, before they recently cast doubt on ECC in general and SuiteB in particular -- and P521 -- for no obvious reason except it's the largest standard curve (to date) and thus appealing to people who don't understand anything more than "big number sounds impressive".

You have the option to get OpenSSL source and build it yourself. It's fairly easy compared to some OSS: beyond a standard C implementation and optional (but highly recommended) per-platform assembler, you basically need only make (on Unix) and perl (and even very old perl is fine). Plus you can make other changes if you need to, or want to. On many systems you do need to fit your custom build into the package/install manager, or else choose to bypass it.

You mention limited bandwidth, but not memory. If memory is an issue, be aware that full OpenSSL is big; there are build options to remove some pieces and make it somewhat leaner, but still nowhere near svelte.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.