4 ms·

This might not contribute much to the discussion, but I just want to add: I for one welcome the coming arrival of ECDH over curve25519 in TLS everywhere. (And

This might not contribute much to the discussion, but I just want to add: I for one welcome the coming arrival of ECDH over curve25519 in TLS everywhere. (And I really hope that comes to pass.)

api 11y ago
Question I don't know the answer to: Is there any chance that ECC is vulnerable to similar issues with static universally agreed upon constants. In ECC these are curves, and is it feasible to "pre-crack" a curve? Or is the space so huge in this case that it would take millions of years of compute time to do so? Someone who knows ECC math better than I do would have to answer this one.
- tptacek 11y ago
  A big part of the whole point of ECC is that it resists index calculus. Also, remember: this isn't a fatal flaw in all of Diffie Hellman. It's a variant of a well-known attack that makes it economical to attack 1024 bit DH, not merely plausible. So far as anyone knows, it does nothing to help attack 2048 bit DH.
  - sarciszewski 11y ago
    Right. 2048-bit RSA/DH is fine, but EdDSA/ECDH is looking more attractive every day (so long as Bernstein or Langley provided the implementation).
  - api 11y ago
    So Curve25519 is pretty much rock solid unless (a) someone discovers genuinely new math or (b) we get a practical quantum computer with enough coherent qubits to actually run the ECC variant of Shor's algorithm. Note the qualifications around (b). Just any QC would not do... it would have to (as far as I know) have a rather "wide" coherent qubit capacity among other characteristics. So what... Curve25519 until 2050? 2100? Hard to say and new math is always a total wildcard, but it seems damn secure. ... and as you say DH and RSA are also great with >2048 bits. 4096 bits is what I typically use.
    - sarciszewski 11y ago
      One of the cryptographers that helped bring us Curve25519, Dr. Lange, is leading efforts to research post-quantum cryptography. http://pqcrypto.eu.org http://pqcrypto.eu.org
    - tptacek 11y ago
      From a mathematical perspective, all of the mainstream curves, from the NIST p- curves to the Brainpool curves, are solid. There are four reasons people use Curve25519: it's faster in software than most implementations of the other curves, it was designed to be mostly misuse-resistant, so you don't have to be as careful checking parameters (a very common vector for ECC curve attacks), it's designed to be simple to make leak-proof implementations (unlike the NIST curves, which are hard to do in constant time), and it has the Dan Bernstein brand. But if we're talking about index calculus attacks, the NIST curves do fine there too.
    - petra 11y ago
      >>So Curve25519 is pretty much rock solid unless (a) someone discovers genuinely new math or After the NSA news happened , schneier said the math is safe , saying/implying you can trust Diffie-Hellman. And now it's not secure. So how can we be so sure of Curve25519 ?
      - deleted 11y ago
        [deleted]
      - sarciszewski 11y ago
        You could never really trust, e.g. 32-bit DH. Context matters. The security of 2048-bit DH versus 1024-bit DH isn't the difference between "one year" and "two years", it's the difference btween "one year" and centuries.
      - tptacek 11y ago
        There's nothing new about the math here. 1024 bit DH has been precarious for over a decade, at least since Tromer costed out an RSA-1024 factoring machine. In other words, people a decade ago were also telling you to avoid DH-1024. What we're looking at today is a more efficient way of exploiting a bug we've known about for a long time.

This might not contribute much to the discussion, but I just want to add: I for one welcome the coming arrival of ECDH over curve25519 in TLS everywhere. (And I really hope that comes to pass.)

api 11y ago

Question I don't know the answer to: Is there any chance that ECC is vulnerable to similar issues with static universally agreed upon constants. In ECC these are curves, and is it feasible to "pre-crack" a curve? Or is the space so huge in this case that it would take millions of years of compute time to do so? Someone who knows ECC math better than I do would have to answer this one.

tptacek 11y ago
A big part of the whole point of ECC is that it resists index calculus. Also, remember: this isn't a fatal flaw in all of Diffie Hellman. It's a variant of a well-known attack that makes it economical to attack 1024 bit DH, not merely plausible. So far as anyone knows, it does nothing to help attack 2048 bit DH.
- sarciszewski 11y ago
  Right. 2048-bit RSA/DH is fine, but EdDSA/ECDH is looking more attractive every day (so long as Bernstein or Langley provided the implementation).
- api 11y ago
  So Curve25519 is pretty much rock solid unless (a) someone discovers genuinely new math or (b) we get a practical quantum computer with enough coherent qubits to actually run the ECC variant of Shor's algorithm. Note the qualifications around (b). Just any QC would not do... it would have to (as far as I know) have a rather "wide" coherent qubit capacity among other characteristics. So what... Curve25519 until 2050? 2100? Hard to say and new math is always a total wildcard, but it seems damn secure. ... and as you say DH and RSA are also great with >2048 bits. 4096 bits is what I typically use.
  - sarciszewski 11y ago
    One of the cryptographers that helped bring us Curve25519, Dr. Lange, is leading efforts to research post-quantum cryptography. http://pqcrypto.eu.org http://pqcrypto.eu.org
  - tptacek 11y ago
    From a mathematical perspective, all of the mainstream curves, from the NIST p- curves to the Brainpool curves, are solid. There are four reasons people use Curve25519: it's faster in software than most implementations of the other curves, it was designed to be mostly misuse-resistant, so you don't have to be as careful checking parameters (a very common vector for ECC curve attacks), it's designed to be simple to make leak-proof implementations (unlike the NIST curves, which are hard to do in constant time), and it has the Dan Bernstein brand. But if we're talking about index calculus attacks, the NIST curves do fine there too.
  - petra 11y ago
    >>So Curve25519 is pretty much rock solid unless (a) someone discovers genuinely new math or After the NSA news happened , schneier said the math is safe , saying/implying you can trust Diffie-Hellman. And now it's not secure. So how can we be so sure of Curve25519 ?
    - deleted 11y ago
      [deleted]
    - sarciszewski 11y ago
      You could never really trust, e.g. 32-bit DH. Context matters. The security of 2048-bit DH versus 1024-bit DH isn't the difference between "one year" and "two years", it's the difference btween "one year" and centuries.
    - tptacek 11y ago
      There's nothing new about the math here. 1024 bit DH has been precarious for over a decade, at least since Tromer costed out an RSA-1024 factoring machine. In other words, people a decade ago were also telling you to avoid DH-1024. What we're looking at today is a more efficient way of exploiting a bug we've known about for a long time.