4 ms·

I wasn't attempting to negate the worth of any of the known security and efficiency properties, I was simply adding that there's significant value in understand

by yarg 7y ago

I wasn't attempting to negate the worth of any of the known security and efficiency properties, I was simply adding that there's significant value in understanding how the curve came to be. Something can be provably secure against all known attacks and still be back-doored. I said "not simply" implying that there are other considerations and not "not" which wold have implied that what you'd stated was unimportant. As to the justification for my opinion, that was based on Bruce Schneier's comments regarding the numbers - which he made long before the Snowden revelations. I'm not saying that the numbers are back-doored, but the situation gives a reasonable justification for pause.

tptacek 7y ago
I wouldn't look to Bruce Schneier for insight about curves.
- GordonS 7y ago
  As a serious question, why not? Isn't Schneier basically a crypto deity?
  - garmaine 7y ago
    No. More of a crypto hack and policy wonk.
    - GordonS 7y ago
      Come on, the man's a legend! Schneier designed Blowfish and was involved in the design of Twofish and Skein. When I was starting out, his book "Applied Cryptography" was both inspirational and informative, and I wouldn't be surprised if it was one of the most successful cryptography books ever written. Schneier has also beeing blogging about security in general for decades; yes, sometimes he necessarily discusses government policy as a result, but I don't see what is wrong with that, or why that would make him a "hack" or "wonk".
      - tptacek 7y ago
        Blowfish isn't good, and it's important never to use it (as a cipher; bcrypt is fine). But that aside: Schneier has had a weird aversion to elliptic curves, has never (that I know of) written anything technical about them, claims to "not trust the math" behind them (whatever that means), and my suspicion is that he simply hasn't studied them in any depth. All I said was: I wouldn't look to Schneier for information about curves.
      - garmaine 7y ago
        Both of those are basically famous for being his work. They didn’t fare super well in the competitions they were submitted to. And they were collaborations, regardless. His books are inspirational and somewhat informative. That means he is a successful author of cryptography books, not a successful cryptographer per se.
        GordonS 7y ago
        Blowfish predates the AES (and I believe he designed this one solo), Twofish was an AES finalist, and more recently Skein was a SHA3 finalist. I'd say his crpyptography credentials check out.
      - garmaine 7y ago
        > Come on, the man's a legend! He’s a self-promoter. A valuable life skill to learn at some point is how to differentiate those who are legendary due to the awesomeness of their own feats, and those who manufacture legend from mediocrity.
        GordonS 7y ago
        That's pretty harsh, given his contribution to the field. FWIW, I met him briefly at a developer conference in Norway a few years ago, and he actually seemed quite humble.

by yarg 7y ago

tptacek 7y ago

I wouldn't look to Bruce Schneier for insight about curves.

GordonS 7y ago
As a serious question, why not? Isn't Schneier basically a crypto deity?
- garmaine 7y ago
  No. More of a crypto hack and policy wonk.
  - GordonS 7y ago
    Come on, the man's a legend! Schneier designed Blowfish and was involved in the design of Twofish and Skein. When I was starting out, his book "Applied Cryptography" was both inspirational and informative, and I wouldn't be surprised if it was one of the most successful cryptography books ever written. Schneier has also beeing blogging about security in general for decades; yes, sometimes he necessarily discusses government policy as a result, but I don't see what is wrong with that, or why that would make him a "hack" or "wonk".
    - tptacek 7y ago
      Blowfish isn't good, and it's important never to use it (as a cipher; bcrypt is fine). But that aside: Schneier has had a weird aversion to elliptic curves, has never (that I know of) written anything technical about them, claims to "not trust the math" behind them (whatever that means), and my suspicion is that he simply hasn't studied them in any depth. All I said was: I wouldn't look to Schneier for information about curves.
    - garmaine 7y ago
      Both of those are basically famous for being his work. They didn’t fare super well in the competitions they were submitted to. And they were collaborations, regardless. His books are inspirational and somewhat informative. That means he is a successful author of cryptography books, not a successful cryptographer per se.
      - GordonS 7y ago
        Blowfish predates the AES (and I believe he designed this one solo), Twofish was an AES finalist, and more recently Skein was a SHA3 finalist. I'd say his crpyptography credentials check out.
    - garmaine 7y ago
      > Come on, the man's a legend! He’s a self-promoter. A valuable life skill to learn at some point is how to differentiate those who are legendary due to the awesomeness of their own feats, and those who manufacture legend from mediocrity.
      - GordonS 7y ago
        That's pretty harsh, given his contribution to the field. FWIW, I met him briefly at a developer conference in Norway a few years ago, and he actually seemed quite humble.