4 ms·

'tptacek would write that no reputable cryptographer believes the NIST curves themselves are backdoored.

by wolf550e 7y ago

deleted 7y ago
[deleted]
1000units 7y ago
Is this a joke? Doesn't everybody believe they're backdoored?
- hannob 7y ago
  There's two stories that often get mixed together. One is an elliptic curve based random number generator (Dual EC DRBG), and yes, everyone who knows the facts believes it's backdoored. Then there's some much more general concerns about the NIST curves themselve. These concerns come down to that a) we don't really know how they were generated (there are some numbers in the paper that just "appear out of nowhere") and b) that they've been created by the NSA. But there's no concrete proof of any backdooring and it seems relatively implausible, as no method is known that would explain how that backdooring would work. I guess most people familiar with the facts don't believe they are backdoored.
  - 1000units 7y ago
    Oh, just that once.
    - tialaramex 7y ago
      We don't actually know for sure that Dual EC is backdoored, we have unexplained constants plus subsequently a way to pick constants that backdoor the algorithm have been discovered. The constants could have been chosen randomly or based on something that would be embarrassing to reveal, e.g. the project leader picked their children's birthdays. Since this algorithm is worse in other ways there is no reason to use it and it's reasonable to treat things that pick Dual EC as problematic because they had no good reason to do that once it became controversial. But we shouldn't forget that it's not actually proven to be backdoored, we have only reasonable suspicions.
      - 1000units 7y ago
        We have a lot of competent people at the NSA.
      - wolf550e 7y ago
        Reading this [1] and then saying that maybe it's not a backdoor, maybe it's the NSA cryptographer's kids' birthdays is completely nuts. 1 - https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf
        1000units 7y ago
        Some people put their faith in the strangest places.
      - lawnchair_larry 7y ago
        We do know a lot more than that now. It was in the Snowden leaks.
      - ohazi 7y ago
        We also know that the NSA secretly paid RSA-the-company $10 million to use dual ec as the default.
        tptacek 7y ago
        We also know that Juniper not only used Dual-EC for their VPNs, but that someone at some point got access to their source tree and rekeyed the backdoor to a new secret. It's obviously a backdoor.
nullc 7y ago
Based on his comments on all matters related to state surveillance and, in particular, on dualec drbg I would take a comment like that from him to be weak evidence that they were backdoored. :) He's spent countless hours tirelessly denying the existence of programs that have subsequently been proven to exist. He clearly has a huge blindspot related to the potential for unlawful and unethical conduct by the US government. What is clear enough about the NIST curves is that they used a high entropy process that would have easily allowed them to grind to select for undisclosed criteria, somewhat inexplicably. Maybe they used this fact to add security against currently non-public attacks? Maybe they used this fact to weaken them against an attack the public doesn't know about. Maybe, like tptacek, they were largely blind to the concern of government backdoors and just didn't care if the process looked somewhat janky. Regardless of the reason no clarification seems likely to every be made. The more frustrating point is that the alternative of choice (curve25519/ed25519) is only available at the 252-bit security level, and current goverment guidance discourages ECC below 384 bits. Higher bit ed25519-alikes are no where near as mature or deployed. If your strategy is try to make choices where in the future you'll never have reason to feel stupid about the choices you made the options aren't really that great right now. You either use 384bit+ NIST and are exposed to the suspicious generation mechanism, use ed448 which is some weirdo cryptosystem few other things use, or use ed25519 and violate NSA's recommendation to use >=384 bits. With each of those options if it later turns out to be a bad choice you'll have plenty of reason to feel stupid.
- andyv 7y ago
  I already feel stupid about using P-256 a few years ago!
- mehrdadn 7y ago
  > He's spent countless hours tirelessly denying the existence of programs that have subsequently been proven to exist. Any chance you could list an example or two?
- nickpsecurity 7y ago
  I'll also add that BULLRUN clearly stated they were backdooring cryptographic standards. At that point, any NSA connection is suspect. Personally, I thought it was brilliant attempt at a NOBUS attack. NOBUS is rarely achievable in practice while simultaneously being deniable.

'tptacek would write that no reputable cryptographer believes the NIST curves themselves are backdoored.

deleted 7y ago

[deleted]

1000units 7y ago

Is this a joke? Doesn't everybody believe they're backdoored?

hannob 7y ago
There's two stories that often get mixed together. One is an elliptic curve based random number generator (Dual EC DRBG), and yes, everyone who knows the facts believes it's backdoored. Then there's some much more general concerns about the NIST curves themselve. These concerns come down to that a) we don't really know how they were generated (there are some numbers in the paper that just "appear out of nowhere") and b) that they've been created by the NSA. But there's no concrete proof of any backdooring and it seems relatively implausible, as no method is known that would explain how that backdooring would work. I guess most people familiar with the facts don't believe they are backdoored.
- 1000units 7y ago
  Oh, just that once.
  - tialaramex 7y ago
    We don't actually know for sure that Dual EC is backdoored, we have unexplained constants plus subsequently a way to pick constants that backdoor the algorithm have been discovered. The constants could have been chosen randomly or based on something that would be embarrassing to reveal, e.g. the project leader picked their children's birthdays. Since this algorithm is worse in other ways there is no reason to use it and it's reasonable to treat things that pick Dual EC as problematic because they had no good reason to do that once it became controversial. But we shouldn't forget that it's not actually proven to be backdoored, we have only reasonable suspicions.
    - 1000units 7y ago
      We have a lot of competent people at the NSA.
    - wolf550e 7y ago
      Reading this [1] and then saying that maybe it's not a backdoor, maybe it's the NSA cryptographer's kids' birthdays is completely nuts. 1 - https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf
      - 1000units 7y ago
        Some people put their faith in the strangest places.
    - lawnchair_larry 7y ago
      We do know a lot more than that now. It was in the Snowden leaks.
    - ohazi 7y ago
      We also know that the NSA secretly paid RSA-the-company $10 million to use dual ec as the default.
      - tptacek 7y ago
        We also know that Juniper not only used Dual-EC for their VPNs, but that someone at some point got access to their source tree and rekeyed the backdoor to a new secret. It's obviously a backdoor.

nullc 7y ago

Based on his comments on all matters related to state surveillance and, in particular, on dualec drbg I would take a comment like that from him to be weak evidence that they were backdoored. :) He's spent countless hours tirelessly denying the existence of programs that have subsequently been proven to exist. He clearly has a huge blindspot related to the potential for unlawful and unethical conduct by the US government. What is clear enough about the NIST curves is that they used a high entropy process that would have easily allowed them to grind to select for undisclosed criteria, somewhat inexplicably. Maybe they used this fact to add security against currently non-public attacks? Maybe they used this fact to weaken them against an attack the public doesn't know about. Maybe, like tptacek, they were largely blind to the concern of government backdoors and just didn't care if the process looked somewhat janky. Regardless of the reason no clarification seems likely to every be made. The more frustrating point is that the alternative of choice (curve25519/ed25519) is only available at the 252-bit security level, and current goverment guidance discourages ECC below 384 bits. Higher bit ed25519-alikes are no where near as mature or deployed. If your strategy is try to make choices where in the future you'll never have reason to feel stupid about the choices you made the options aren't really that great right now. You either use 384bit+ NIST and are exposed to the suspicious generation mechanism, use ed448 which is some weirdo cryptosystem few other things use, or use ed25519 and violate NSA's recommendation to use >=384 bits. With each of those options if it later turns out to be a bad choice you'll have plenty of reason to feel stupid.

andyv 7y ago
I already feel stupid about using P-256 a few years ago!
mehrdadn 7y ago
> He's spent countless hours tirelessly denying the existence of programs that have subsequently been proven to exist. Any chance you could list an example or two?
nickpsecurity 7y ago
I'll also add that BULLRUN clearly stated they were backdooring cryptographic standards. At that point, any NSA connection is suspect. Personally, I thought it was brilliant attempt at a NOBUS attack. NOBUS is rarely achievable in practice while simultaneously being deniable.