5 ms·

Thanks for the pointer to BADA55, I had not seen that. Do you think it's possible for constants (selected in the way the constants for ed25519 were selected) t

by habitue 11y ago

Thanks for the pointer to BADA55, I had not seen that. Do you think it's possible for constants (selected in the way the constants for ed25519 were selected) to be backdoored ala BADA55? It seems the vulnerabilities come from using hashing algorithms on some small constant, not from the constant itself being something simply constructed. Also, it looks like DJB did alight on PinkBikeShed originally[1] but rejected it for technical reasons. (Reasons I can't evaluate myself). Is my understanding correct that the PinkBikeShed curve has more minimal parameters than ed25519, but that it doesn't satisfy all of the security criteria that ed25519 does? [1] https://www.ietf.org/mail-archive/web/cfrg/current/msg05745.html https://www.ietf.org/mail-archive/web/cfrg/current/msg05745....

tptacek 11y ago
There is a very fiddly technical reason why PinkBikeShed is more user-friendly than Curve25519. Bernstein would say that it's a powerful security argument, but it's more of a nice- to- have than a must-have. Curve25519 won because it had an installed base.
- CiPHPerCoder 11y ago
  For anyone following this part of the comment thread, the mailing list discussion about these topics is worth a read too: https://www.ietf.org/mail-archive/web/cfrg/current/msg05619.html https://www.ietf.org/mail-archive/web/cfrg/current/msg05619....
  - acqq 11y ago
    The text sketches a proof how PinkBikeShed from Microsoft is worse. He also ends with "I didn't bother writing down a comprehensive critique of PinkBikeShed, and didn't imagine that anyone would ever try to revive that curve."
    - tptacek 11y ago
      It's a whole lot of sentences for a very simple difference. I think "proof" is pushing it a bit far.
      - acqq 11y ago
        He wrote a lot, but it's very clear what his principles in this case are. To be constructive, other experts should either point to the principles with which they disagree or if they do agree point to the errors in his use of them.
        tptacek 11y ago
        In that argument, Microsoft would say that performance being equal, it's more important for parameters to be minimal so that the curve is maximally rigid and trustworthy. Bernstein would say that it's more important that there are no implementation pitfalls, even very subtle ones that will be hard to exploit. I agree with Bernstein but I won't pretend it's a totally cut and dried argument. What won the argument wasn't so much the merits of Bernstein's case, but that Microsoft was in effect arguing for something that would break compatibility with the 25519 installed base.
pdkl95 11y ago
> BADA55, I had not seen that. If you want a good laugh (and some discussion of BADA55), you might enjoy this[1] talk where DJB praises his "new job" at Verizon. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...

by habitue 11y ago

tptacek 11y ago

There is a very fiddly technical reason why PinkBikeShed is more user-friendly than Curve25519. Bernstein would say that it's a powerful security argument, but it's more of a nice- to- have than a must-have. Curve25519 won because it had an installed base.

CiPHPerCoder 11y ago
For anyone following this part of the comment thread, the mailing list discussion about these topics is worth a read too: https://www.ietf.org/mail-archive/web/cfrg/current/msg05619.html https://www.ietf.org/mail-archive/web/cfrg/current/msg05619....
- acqq 11y ago
  The text sketches a proof how PinkBikeShed from Microsoft is worse. He also ends with "I didn't bother writing down a comprehensive critique of PinkBikeShed, and didn't imagine that anyone would ever try to revive that curve."
  - tptacek 11y ago
    It's a whole lot of sentences for a very simple difference. I think "proof" is pushing it a bit far.
    - acqq 11y ago
      He wrote a lot, but it's very clear what his principles in this case are. To be constructive, other experts should either point to the principles with which they disagree or if they do agree point to the errors in his use of them.
      - tptacek 11y ago
        In that argument, Microsoft would say that performance being equal, it's more important for parameters to be minimal so that the curve is maximally rigid and trustworthy. Bernstein would say that it's more important that there are no implementation pitfalls, even very subtle ones that will be hard to exploit. I agree with Bernstein but I won't pretend it's a totally cut and dried argument. What won the argument wasn't so much the merits of Bernstein's case, but that Microsoft was in effect arguing for something that would break compatibility with the 25519 installed base.

pdkl95 11y ago

> BADA55, I had not seen that. If you want a good laugh (and some discussion of BADA55), you might enjoy this[1] talk where DJB praises his "new job" at Verizon. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...