4 ms·

The construction of the NIST curves essentially preludes trapdoors. It doesn't completely preclude having a purposefully weak curve based on some publicly unkn

by nullc 7y ago

The construction of the NIST curves essentially preludes trapdoors. It doesn't completely preclude having a purposefully weak curve based on some publicly unknown weakness. ... but at the same time it also doesn't preclude the the curves having been selected to be stronger against some publicly unknown weakness (as was done with DES). [Not that I'd recommend them.]

deleted 7y ago
[deleted]
garmaine 7y ago
Greg, do we know that to be true of all use cases though?
- nullc 7y ago
  Would you clarifying your question a bit? My comment was pointing out that those NIST curves like P-256 and P-224 can't have a trapdoor-- meaning a hidden secret key that allows the NSA and only the NSA to compromise the use-- in the curve themselves. Some application of the curve could have its own trapdoor, as dualECdrbg did.
  - garmaine 7y ago
    Well the NIST curves use random primes, and they're not the obvious, largest possible primes that meet the necessary security requirements. So maybe they were chosen according to their susceptibility to some unknown attack (or, charitably, their non-susceptibility). I think we agree up to this point. But when the space of potential attacks is an unknown-unknown, can we really constrain with confidence what attacks might exist? Maybe the prime group was chosen to have some relationship to a composite group for which the NSA knows the prime factors? I know this doesn't jive with our current understanding of number theory, but the point is it is hard to speculate about unknown-unknowns. Can we be certain that every crazy thing we think of is ruled out by our proven, not conjectured understanding of number theory?
    - nullc 7y ago
      My post specifically pointed out "It doesn't completely preclude having a purposefully weak curve based on some publicly unknown weakness." -- just that there is nowhere to embed a secret key that only the NSA would know. The only room in it would be for narrow vulnerabilities that others could discover-- just because there aren't that many bits of control. [As an, aside, the NIST curves do not use random primes, E.g. P-256 is 2^256 - 2^224 + 2^192 + 2^96 - 1, which is a solinas prime with a pretty obvious performance driven structure. As is the case for all the other NIST P-whatever curves. Using primes chosen for field performance is pretty common, e.g. curve 25519 uses a crandall prime]

by nullc 7y ago

deleted 7y ago

[deleted]

garmaine 7y ago

Greg, do we know that to be true of all use cases though?

nullc 7y ago
Would you clarifying your question a bit? My comment was pointing out that those NIST curves like P-256 and P-224 can't have a trapdoor-- meaning a hidden secret key that allows the NSA and only the NSA to compromise the use-- in the curve themselves. Some application of the curve could have its own trapdoor, as dualECdrbg did.
- garmaine 7y ago
  Well the NIST curves use random primes, and they're not the obvious, largest possible primes that meet the necessary security requirements. So maybe they were chosen according to their susceptibility to some unknown attack (or, charitably, their non-susceptibility). I think we agree up to this point. But when the space of potential attacks is an unknown-unknown, can we really constrain with confidence what attacks might exist? Maybe the prime group was chosen to have some relationship to a composite group for which the NSA knows the prime factors? I know this doesn't jive with our current understanding of number theory, but the point is it is hard to speculate about unknown-unknowns. Can we be certain that every crazy thing we think of is ruled out by our proven, not conjectured understanding of number theory?
  - nullc 7y ago
    My post specifically pointed out "It doesn't completely preclude having a purposefully weak curve based on some publicly unknown weakness." -- just that there is nowhere to embed a secret key that only the NSA would know. The only room in it would be for narrow vulnerabilities that others could discover-- just because there aren't that many bits of control. [As an, aside, the NIST curves do not use random primes, E.g. P-256 is 2^256 - 2^224 + 2^192 + 2^96 - 1, which is a solinas prime with a pretty obvious performance driven structure. As is the case for all the other NIST P-whatever curves. Using primes chosen for field performance is pretty common, e.g. curve 25519 uses a crandall prime]