4 ms·
> ciphers developed in the open usually do things like key off digits of pi It should be noted that we should be very wary of these types of "nothing up my sle
by cyphar 7y ago
> ciphers developed in the open usually do things like key off digits of pi
It should be noted that we should be very wary of these types of "nothing up my sleeve" numbers. djb showed[1] that with enough effort you could come up with more than a million "obviously not backdoored" numbers (this was done in the context of elliptic curves) -- enough to exploit a million-to-one unknown-by-the-public vulnerability.
[1]: https://youtu.be/Cj3PN5-n108 https://youtu.be/Cj3PN5-n108
- throwawaymath 7y agoThe context Bernstein is talking about is very meaningful here. The mathematics of public-key cryptography provides a rich tapestry for covering up hidden backdoors. ARX ciphers are very simple compared to elliptic curves, and the complexity of round constants isn't really comparable to that of curves.
- cyphar 7y agoRight, I should've added I agree with GP that ARX ciphers are incredibly simple and the ability to backdoor them would be a very novel (and concerning) discovery. My point is that "the values come from pi" is not necessarily proof that the constants really are "nothing up my sleeve". Bernstein was discussing this in the context of NIST curves (which could be backdoored), but the same one-in-a-million maths works for any constants (so long as you happen to know a weak-constants vulnerability that isn't known by the public).