3 ms·
Here's what happened: I initially posted the parent comment, it's just the introduction of SafeCurves with its original URL, and I cited that Curve25519 has ad
by segfaultbuserr 7y ago
Here's what happened:
I initially posted the parent comment, it's just the introduction of SafeCurves with its original URL, and I cited that Curve25519 has advantages of better treatment of timing side-channels and invalid curves in its design. I never mentioned "backdoor" at all because I thought it was unimportant.
Then user "yarg" replied my comment, said the point of Curve25519 here is that it uses mathematically-justifiable constants. And to me, what the author seems to be implying, is (1) that those security advantages I cited before are not too important, and (2) that the main concern is that NIST curves have "backdoors".
So as a response, I gave a somewhat editorialized summary of SafeCurve's findings for those who didn't want to read the whole thing. "yarg" seems to be interested on the issue of backdoor, so I gave some personal commentary on the concern of backdoors in the coefficients of NIST curves, and the Internet folklore of why Bitcoin used that unusual Koblitz curve.
But what I wanted to communicate was that it wasn't all about the backdoors, so I summarized all the criteria in SafeCurve to make the point. For example I said Curve25519 allowed "simple" multiplication and addition, and it makes constant-time implementation easier than NIST curves.
I think it's fair enough, do you?
- yarg 7y agoI wasn't attempting to negate the worth of any of the known security and efficiency properties, I was simply adding that there's significant value in understanding how the curve came to be. Something can be provably secure against all known attacks and still be back-doored. I said "not simply" implying that there are other considerations and not "not" which wold have implied that what you'd stated was unimportant. As to the justification for my opinion, that was based on Bruce Schneier's comments regarding the numbers - which he made long before the Snowden revelations. I'm not saying that the numbers are back-doored, but the situation gives a reasonable justification for pause.
- tptacek 7y agoI wouldn't look to Bruce Schneier for insight about curves.
- GordonS 7y agoAs a serious question, why not? Isn't Schneier basically a crypto deity?
- garmaine 7y agoNo. More of a crypto hack and policy wonk.
- GordonS 7y agoCome on, the man's a legend! Schneier designed Blowfish and was involved in the design of Twofish and Skein. When I was starting out, his book "Applied Cryptography" was both inspirational and informative, and I wouldn't be surprised if it was one of the most successful cryptography books ever written. Schneier has also beeing blogging about security in general for decades; yes, sometimes he necessarily discusses government policy as a result, but I don't see what is wrong with that, or why that would make him a "hack" or "wonk".
- tptacek 7y agoBlowfish isn't good, and it's important never to use it (as a cipher; bcrypt is fine). But that aside: Schneier has had a weird aversion to elliptic curves, has never (that I know of) written anything technical about them, claims to "not trust the math" behind them (whatever that means), and my suspicion is that he simply hasn't studied them in any depth. All I said was: I wouldn't look to Schneier for information about curves.
- garmaine 7y agoBoth of those are basically famous for being his work. They didn’t fare super well in the competitions they were submitted to. And they were collaborations, regardless. His books are inspirational and somewhat informative. That means he is a successful author of cryptography books, not a successful cryptographer per se.
- 7y ago