4 ms·
I bet there are a similar number of pitfalls with ECC, but (depending on the specific weakness) we just have a ~50-2000 year head start with RSA because prime n
by ohazi 6y ago
I bet there are a similar number of pitfalls with ECC, but (depending on the specific weakness) we just have a ~50-2000 year head start with RSA because prime numbers have been studied for far longer.
- ggm 6y agoHe explicitly said it doesn't suffer from identical problems, notably not having padding requirements and not having to select primes: users select random keys instead. Anything can be badly implemented. ECC can be badly implemented. Two specific, often repeated problems are not shared by ECC
- ohazi 6y agoYou, me, or djb still have to select a curve -- that's where I expect the pitfalls will be.
- ggm 6y agoLibsodium. Djb or his equivalent did that already and if there is a timing attack, it will get found and fixed faster.
- ohazi 6y agoI'm not referring to implementation bugs, I'm referring to choice of curve, which can't be changed after the fact. Look at the table at the bottom of: https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/ Today, Curve25519 is a good choice because it's popular and checks all the boxes. But how many undiscovered columns are in this table? My top level comment seems unpopular, so for what it's worth, I'll clarify that I definitely agree that there are fewer knobs for the non-cryptographer implementer to get wrong with ECC. But that's because the only way to implement an ECC system exactly as specified by the cryptographers. That's clearly an improvement over RSA, but I remain unconvinced that the cryptographers designing the curves are infallible. There are curves and curve parameters that, for various reasons, are bad. Maybe there's a proof that it's impossible to do better than Curve25519, but if there is, I haven't seen it, and tptacek would rather be snarky than provide a reference. Is it impossible for more columns to show up in that safecurves table? If so, prove it. Otherwise, I think my top level suspicion is reasonable.
- tptacek 6y agoThere's a great Boneh talk discussing the history of elliptic curves that refutes this weird argument. At any rate, the history of elliptic curves and RSA in cryptography is intimately intertwined.
- ohazi 6y agoI'm sure there is. Why don't you provide a pointer to this talk instead of being weirdly disparaging.
- tptacek 6y agoDM for my rate card.
- dan-robertson 6y agoIs this the talk? https://m.youtube.com/watch?v=4M8_Oo7lpiA https://m.youtube.com/watch?v=4M8_Oo7lpiA