6 ms·

"NIST publishes recommendations on which ones to use, but people prefer to use other curves (like secp256k1) that are less likely to have backdoors built into t

"NIST publishes recommendations on which ones to use, but people prefer to use other curves (like secp256k1) that are less likely to have backdoors built into them" Does this make any sense? How is a curve going to have backdoors on it? Or he means a specific implementation? Or is this a joke? I'm confused

stcredzero 5y ago
There's been a history of mathematical information used in cryptography produced by the NSA, for which it's later revealed, they had pre-developed an attack. Example: the s-boxes of DES.
- foo92691 5y ago
  Except NSA strengthened DES against this not-yet-known-to-the-public attack (differential cryptanalysis). https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA's_involvement_in_the_design https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA's... https://en.wikipedia.org/wiki/Differential_cryptanalysis#History https://en.wikipedia.org/wiki/Differential_cryptanalysis#His...
  - stcredzero 5y ago
    While keeping DES to 56 bits, to keep the attack within reach.
inter_netuser 5y ago
ECC NIST curves were proposed by the NSA. They have some unusual hand-selected constants that nobody quite understands exactly why they were selected. https://miracl.com/blog/backdoors-in-nist-elliptic-curves/ https://miracl.com/blog/backdoors-in-nist-elliptic-curves/ “Working in collaboration with the NSA, NIST included three sets of recommended elliptic curves in FIPS 186-2 that were generated using the algorithms in the American National Standard (ANS) X9.62 standard and Institute of Electrical and Electronics Engineers (IEEE) P1363 standards.”: What exactly is NIST’s justification for making claims regarding the method that NSA used to generate these curves? The fact that a hash matches is publicly verifiable, but the distribution of “random” inputs is not. I have heard NSA employees claiming that the “random” inputs were actually generated as hashes of English text chosen (and later forgotten) by Jerry Solinas." https://csrc.nist.gov/CSRC/media/Publications/sp/800-186/draft/documents/sp800-186-draft-comments-received.pdf https://csrc.nist.gov/CSRC/media/Publications/sp/800-186/dra... It's all quite public.
scoofy 5y ago
Here's a computerphile video that explains it very simply: https://youtu.be/nybVFJVXbww https://youtu.be/nybVFJVXbww
- Cantinflas 5y ago
  Thanks! Thanks to the other answers too. Amazing stuff!
- sundarurfriend 5y ago
  > But then the Snowden leaks came along, and it looks even more suspicious. > Money was changing hands between the NSA and companies, to have them install this as their standard for number generation. That's deeply suspicious. (-from the video) That's one piece of information I didn't know, and doesn't usually get mentioned in the discussions I've seen about this.
rkagerer 5y ago
https://services.math.duke.edu/~bray/Courses/89s-MOU/2016/Papers/BAS_Paper3_EllipticCurveCryptography.pdf https://services.math.duke.edu/~bray/Courses/89s-MOU/2016/Pa... Quoting from the paper: The standard given by the NIST gives a list of explicit parameters ... describing the elliptic curve behind the algorithm. Examining the points P and Q here, it is obvious why cryptographers were suspicious of the Dual EC ... once the scalar k is known, it is a “simple matter to determine the secret internal state s of the pseudo-random bit generator” [6], by observing as few as 32 bytes of output. It goes on to quote one of the NSA contractors who admitted that instead of being randomly chosen, "Q is (in essence) the public key for some random private key." "It could also be generated like a(nother) canonical G, but NSA kyboshed this idea, and I was not allowed to publicly discuss it, just in case you may think of going there." Straying from the prescribed points was discouraged, and NIST only provided FIPS validation to clients using the original P and Q. More recently, GPRS was also shown to have been intentionally weakened - presumably to pass export controls - although in this case I think it was the algorithm and not a "cherry picked" curve: https://eprint.iacr.org/2021/819.pdf https://eprint.iacr.org/2021/819.pdf

stcredzero 5y ago

There's been a history of mathematical information used in cryptography produced by the NSA, for which it's later revealed, they had pre-developed an attack. Example: the s-boxes of DES.

foo92691 5y ago
Except NSA strengthened DES against this not-yet-known-to-the-public attack (differential cryptanalysis). https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA's_involvement_in_the_design https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA's... https://en.wikipedia.org/wiki/Differential_cryptanalysis#History https://en.wikipedia.org/wiki/Differential_cryptanalysis#His...
- stcredzero 5y ago
  While keeping DES to 56 bits, to keep the attack within reach.

inter_netuser 5y ago

ECC NIST curves were proposed by the NSA. They have some unusual hand-selected constants that nobody quite understands exactly why they were selected. https://miracl.com/blog/backdoors-in-nist-elliptic-curves/ https://miracl.com/blog/backdoors-in-nist-elliptic-curves/ “Working in collaboration with the NSA, NIST included three sets of recommended elliptic curves in FIPS 186-2 that were generated using the algorithms in the American National Standard (ANS) X9.62 standard and Institute of Electrical and Electronics Engineers (IEEE) P1363 standards.”: What exactly is NIST’s justification for making claims regarding the method that NSA used to generate these curves? The fact that a hash matches is publicly verifiable, but the distribution of “random” inputs is not. I have heard NSA employees claiming that the “random” inputs were actually generated as hashes of English text chosen (and later forgotten) by Jerry Solinas." https://csrc.nist.gov/CSRC/media/Publications/sp/800-186/draft/documents/sp800-186-draft-comments-received.pdf https://csrc.nist.gov/CSRC/media/Publications/sp/800-186/dra... It's all quite public.

scoofy 5y ago

Here's a computerphile video that explains it very simply: https://youtu.be/nybVFJVXbww https://youtu.be/nybVFJVXbww

Cantinflas 5y ago
Thanks! Thanks to the other answers too. Amazing stuff!
sundarurfriend 5y ago
> But then the Snowden leaks came along, and it looks even more suspicious. > Money was changing hands between the NSA and companies, to have them install this as their standard for number generation. That's deeply suspicious. (-from the video) That's one piece of information I didn't know, and doesn't usually get mentioned in the discussions I've seen about this.

rkagerer 5y ago

https://services.math.duke.edu/~bray/Courses/89s-MOU/2016/Papers/BAS_Paper3_EllipticCurveCryptography.pdf https://services.math.duke.edu/~bray/Courses/89s-MOU/2016/Pa... Quoting from the paper: The standard given by the NIST gives a list of explicit parameters ... describing the elliptic curve behind the algorithm. Examining the points P and Q here, it is obvious why cryptographers were suspicious of the Dual EC ... once the scalar k is known, it is a “simple matter to determine the secret internal state s of the pseudo-random bit generator” [6], by observing as few as 32 bytes of output. It goes on to quote one of the NSA contractors who admitted that instead of being randomly chosen, "Q is (in essence) the public key for some random private key." "It could also be generated like a(nother) canonical G, but NSA kyboshed this idea, and I was not allowed to publicly discuss it, just in case you may think of going there." Straying from the prescribed points was discouraged, and NIST only provided FIPS validation to clients using the original P and Q. More recently, GPRS was also shown to have been intentionally weakened - presumably to pass export controls - although in this case I think it was the algorithm and not a "cherry picked" curve: https://eprint.iacr.org/2021/819.pdf https://eprint.iacr.org/2021/819.pdf