[Cryptography-dev] The ECDH vulnerability

2018-07-23 Thread Roland Hedberg
In https://blogs.adobe.com/security/2017/03/critical-vulnerability-uncovered-in-json-encryption.html Antonio Sanso discusses a vulnerability when doing Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES). Can cryptography help me with this ? Basically, can I use cryptogr

Re: [Cryptography-dev] The ECDH vulnerability

2018-07-23 Thread Alex Gaynor
When you load an object into an EllipticCurvePublicKey instance, we verify that the point is on the curve. EllipticCurvePrivateKey.exchange(ECDH(), public_key) will also refuse to perform an excahgen where the public and private keys aren't on the same curve. Alex On Mon, Jul 23, 2018 at 4:53 PM