4 ms·

I always was curious about about one thing with DJB. Even DJB must to admire that focusing almost everything in modern crypto world around DJB is not _secure_.

by ex3ndr 11y ago

I always was curious about about one thing with DJB. Even DJB must to admire that focusing almost everything in modern crypto world around DJB is not _secure_. Curve25519 became default in OpenSSH, used in Signal in Axolotl Ratchet (and our project - actor.im too) and so on. It is going to be everywhere. And all lines came to one specific person.

dchest 11y ago
So? Curve25519 provides secure parameters for ECC, why not use it everywhere? How's that not secure? Is RSA secure? Is it because there were 3 people involved?
- ex3ndr 11y ago
  Good Point.RSA security depends mostly on how you build your private keys and ECC security depends on what parameters and what curve was chosen. Russians cryptoexperts doesn't fully trust DJB they found that at the last iteration of picking parameters by DJB for Curve25519 was a bit questionable. Changes was done for "better performance" but no one found what exactly was speeded up. I don't know details, but when curve parameters was tried to be being compromised by NSA was almost always was about adding such "performance optimizations".
  - dchest 11y ago
    Sorry, you sound like those crypto nuts from various cryptography mailing lists. Curve25519 has been discussed to death during CFRG selection process (see https://news.ycombinator.com/item?id=11161315 https://news.ycombinator.com/item?id=11161315). If you (or these "Russian cryptoexperts") have legitimate concerns, please publish them and save the world!
    - ex3ndr 11y ago
      Thank you i will forward it to them.
  - sarciszewski 11y ago
    > RSA security depends mostly on how you build your private keys and ECC security depends on what parameters and what curve was chosen. No. RSA security depends on getting your parameters right and padding. http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1 http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-... http://framework.zend.com/security/advisory/ZF2015-10 http://framework.zend.com/security/advisory/ZF2015-10 > Russians cryptoexperts doesn't fully trust DJB they found that at the last iteration of picking parameters by DJB for Curve25519 was a bit questionable. Tell them to publish their findings and propose a better solution. > Changes was done for "better performance" but no one found what exactly was speeded up. What "changes" exactly? The word "changes" implies there was an early draft with vastly different parameters. > I don't know details, but when curve parameters was tried to be being compromised by NSA was almost always was about adding such "performance optimizations". If you don't know the details, try doing some research. Knowledge is healthy.

by ex3ndr 11y ago

dchest 11y ago

So? Curve25519 provides secure parameters for ECC, why not use it everywhere? How's that not secure? Is RSA secure? Is it because there were 3 people involved?

ex3ndr 11y ago
Good Point.RSA security depends mostly on how you build your private keys and ECC security depends on what parameters and what curve was chosen. Russians cryptoexperts doesn't fully trust DJB they found that at the last iteration of picking parameters by DJB for Curve25519 was a bit questionable. Changes was done for "better performance" but no one found what exactly was speeded up. I don't know details, but when curve parameters was tried to be being compromised by NSA was almost always was about adding such "performance optimizations".
- dchest 11y ago
  Sorry, you sound like those crypto nuts from various cryptography mailing lists. Curve25519 has been discussed to death during CFRG selection process (see https://news.ycombinator.com/item?id=11161315 https://news.ycombinator.com/item?id=11161315). If you (or these "Russian cryptoexperts") have legitimate concerns, please publish them and save the world!
  - ex3ndr 11y ago
    Thank you i will forward it to them.
- sarciszewski 11y ago
  > RSA security depends mostly on how you build your private keys and ECC security depends on what parameters and what curve was chosen. No. RSA security depends on getting your parameters right and padding. http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1 http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-... http://framework.zend.com/security/advisory/ZF2015-10 http://framework.zend.com/security/advisory/ZF2015-10 > Russians cryptoexperts doesn't fully trust DJB they found that at the last iteration of picking parameters by DJB for Curve25519 was a bit questionable. Tell them to publish their findings and propose a better solution. > Changes was done for "better performance" but no one found what exactly was speeded up. What "changes" exactly? The word "changes" implies there was an early draft with vastly different parameters. > I don't know details, but when curve parameters was tried to be being compromised by NSA was almost always was about adding such "performance optimizations". If you don't know the details, try doing some research. Knowledge is healthy.