论文标题
设置并忘记它！即时整合的交钥匙ECC
Set It and Forget It! Turnkey ECC for Instant Integration
论文作者
论文摘要
从历史上看，椭圆曲线密码学（ECC）是一个应用加密的活跃领域，最近的重点是高速，恒定时间和正式验证的实现。虽然有几个异常值，所有这些概念在现实世界中的部署中加入并着陆，但通常是逐案的基础：例如库可能具有此类X25519或P-256代码，但对于所有曲线而言，都不是。在这项工作中，我们提出并实施一种方法，该方法可以完全自动化ECC堆栈与上述属性的实现，测试和集成。我们通过将无缝集成到三个现实世界项目中来证明我们的方法论的灵活性和适用性：OpenSSL，Mozilla的NSS和Gost OpenSSL Engine，在任何给定的策略，密钥同意，签署，签名，以及验证，以及相应地，在任何给定的策略上达到了9.5倍，4.5倍，13.3倍和3.7倍的速度。此外，我们通过发现OpenSSL中的缺陷和脆弱性以及在俄罗斯标准中的规范级别脆弱性来展示我们的测试方法的功效。我们的工作弥合了重要的应用加密研究结果与已部署软件之间的差距，从而充分自动化了该过程。
Historically, Elliptic Curve Cryptography (ECC) is an active field of applied cryptography where recent focus is on high speed, constant time, and formally verified implementations. While there are a handful of outliers where all these concepts join and land in real-world deployments, these are generally on a case-by-case basis: e.g. a library may feature such X25519 or P-256 code, but not for all curves. In this work, we propose and implement a methodology that fully automates the implementation, testing, and integration of ECC stacks with the above properties. We demonstrate the flexibility and applicability of our methodology by seamlessly integrating into three real-world projects: OpenSSL, Mozilla's NSS, and the GOST OpenSSL Engine, achieving roughly 9.5x, 4.5x, 13.3x, and 3.7x speedup on any given curve for key generation, key agreement, signing, and verifying, respectively. Furthermore, we showcase the efficacy of our testing methodology by uncovering flaws and vulnerabilities in OpenSSL, and a specification-level vulnerability in a Russian standard. Our work bridges the gap between significant applied cryptography research results and deployed software, fully automating the process.
