4 ms·
The NIST curves also have constants which may or may not be manipulated. Bruce Schneier recommends against using them.
by _yy 11y ago
The NIST curves also have constants which may or may not be manipulated.
Bruce Schneier recommends against using them.
- CiPHPerCoder 11y agoI would recommend against using them if your adversary is the NSA and your threat model comes wrapped in tin foil (and if I didn't, I'd get ignored anyway). If so, use NaCl/libsodium at the application layer and don't rely on ECDSA alone. If your threat model is "criminals", ECDSA is less insane than RSA (provided, once again, you're not implementing it yourself, you're relying on developed by a team of cryptographers and security engineers).
- Dylan16807 11y agoThreat model wrapped in tin foil? I don't understand what you mean, are you suggesting paranoia? My threat model includes NSA dragnets but not being specifically targeted by the NSA.
- CiPHPerCoder 11y agoIn that case, active attacks against Weierstrass field arithmetic isn't part of your threat model and ECDSA/ECDH over the NIST curves is fine.
- Dylan16807 11y agoSo this is something that can't be done en masse? Okay, thanks.
- IncRnd 11y ago>> Threat model wrapped in tin foil? I don't understand what you mean, are you suggesting paranoia? That term likely means one of two things: guarding against a particularly capable attacker or paranoia for others
- mkj 11y agoNSA dragnets won't decrypt things using dodgy curves for signatures (ECDSA), only things using dodgy curves for key exchange (ECDH).
- tptacek 11y agoEven Bernstein doesn't argue that the NIST curve seeds are actually backdoors. Schneier isn't a curve researcher; in fact, he's more like an anti-curve pundit. I'm not sure his opinion is all that powerful. Regardless, I'm not suggesting new cryptosystems should use the NIST P-curves. They shouldn't; those curves are just as tricky to use as RSA.
- stock_toaster 11y agoWhat about the NSA "freaking out"[1] about ECC in general? [1]: http://blog.cryptographyengineering.com/2015/10/a-riddle-wrapped-in-curve.html http://blog.cryptographyengineering.com/2015/10/a-riddle-wra...
- tptacek 11y agoRodents of unusual size? I don't think they exist.
- stock_toaster 11y agoYour vote of confidence is overwhelming. ;)