5 ms·

Not quite: he doesn't trust the constants. That's a big difference. He believes based on reading secret Snowden papers that the NSA has manipulated them via rel

Not quite: he doesn't trust the constants. That's a big difference. He believes based on reading secret Snowden papers that the NSA has manipulated them via relationships with the industry. There are other curves that are NOT from NIST, like C25519, that are popular. In fact, the twisted edwards curve computation variant is also growing, which isn't the "traditional" (does that even make sense?) elliptic curve. Now that doesn't mean the NSA hasn't fiddled with C25519, but I'd be surprised if they mind-controlled (or extorted) Bernstein into publishing a compromised curve.

tptacek 5y ago
My feeling is that I could back up both of these statements; the one you made, but also the one I made. He was saying these things before Snowden. And: again, just look at what he's published. He's not Satoshi. (The NIST P-curves aren't backdoored.)
- deleted 5y ago
  [deleted]
- SavantIdiot 5y ago
  > I could back up both of these statements; That's what I did, Bernstein could be compromised. > He's not Satoshi. I sat on a panel with him at an Arm conference, he's a great guy and easy to talk to and doesn't write anything like Satoshi: but I could care less if he is Satoshi. FWIW, I, too, think crypto currency is a huge scam.
  - nullc 5y ago
    The design of Curve25519 and its analogs has an extremely limited design space. If there is an engineered weakness in Curve25519 than it is likely that any curve that we could select would be likely to have the same unknown weakness. In the literature this is called "rigid" design.
- nullc 5y ago
  >(The NIST P-curves aren't backdoored.) Unfortunately, we have no way to validate that the NSA did not grind the "seed" used to generate their parameters to search for curves which were strong or weak against some publicly unknown property which is only found in candidate curves at a one in a billion level. This is a weakness in the methodology used to pick the parameters, somewhat lovingly mocked by the BADA55 curves: https://bada55.cr.yp.to/vr.html https://bada55.cr.yp.to/vr.html It's not unreasonable for people to be concerned about this. Injecting intentional weaknesses into cryptosystems used by others was a fundamental objective for the NSA, which drove programs as significant as the CIA literally purchasing the at-the-time world largest manufacturer of encipher machines in order to ensure that it continued ship NSA designed intentionally weakened systems for decades ( https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-... ). That was, of course, somewhat before the establishment of the relevant ECC standards-- but the cloud of operational secrecy prevents us from knowing that much about what NSA has been up to more recently. The curve used in Bitcoin though isn't a NIST curve, and its generation procedure is about as close as you can get to rigid parameters without having rigid parameters as an explicit design goal. a=0 (required for the endomorphism), field is 3 mod 4 for fast sqrt, increment field from 2^256-2^32-1024 (fast limb structure) until you find a prime field with a non-trivial cube root of unity (required for endomorphism) and until you can obtain a curve with prime order, set B to the lowest value that does. The result of that procedure is secp256k1. (you can actually drop some of the requirements above and still get the same parameters too, but I am pretty confident that this was their search criteria) -- so no high entropy "random" inputs.
  - tptacek 5y ago
    We can go back and forth on this. I don't agree with you about the P-curves, you will make well-constructed rebuttals to anything I say about this, we can reconstruct the thread from the search bar, let's not bother. I'd like to think we might be on the same page about Schneier and curves.
    - nullc 5y ago
      > I'd like to think we might be on the same page about Schneier and curves. Agreed. As I think we're both agreeing that it's a subject where well informed people could have a reasonable debate and disagreement, if you've got a reasonable link you'd suggest for the perspective you've taken it would be helpful to provide it (I provided the BADA55 curve page for that purpose)! (I could suggest one, but I'd prefer one you like!)
- john_alan 5y ago
  > The NIST P-curves aren't backdoored How can you assert this? Can you explain the coefficient choices?
  - wolf550e 5y ago
    The argument is basically this: https://crypto.stackexchange.com/a/12917/24949 https://crypto.stackexchange.com/a/12917/24949
windsok 5y ago
It is curious that satoshi chose to use an uncommon, non-NIST curve for bitcoin. https://en.bitcoin.it/wiki/Secp256k1 https://en.bitcoin.it/wiki/Secp256k1
- ashtonkem 5y ago
  Satoshi in general appears to have been quite skeptical of the government, so it's not that surprising that they would not have trusted NIST curves.

tptacek 5y ago

My feeling is that I could back up both of these statements; the one you made, but also the one I made. He was saying these things before Snowden. And: again, just look at what he's published. He's not Satoshi. (The NIST P-curves aren't backdoored.)

deleted 5y ago
[deleted]
SavantIdiot 5y ago
> I could back up both of these statements; That's what I did, Bernstein could be compromised. > He's not Satoshi. I sat on a panel with him at an Arm conference, he's a great guy and easy to talk to and doesn't write anything like Satoshi: but I could care less if he is Satoshi. FWIW, I, too, think crypto currency is a huge scam.
- nullc 5y ago
  The design of Curve25519 and its analogs has an extremely limited design space. If there is an engineered weakness in Curve25519 than it is likely that any curve that we could select would be likely to have the same unknown weakness. In the literature this is called "rigid" design.
nullc 5y ago
>(The NIST P-curves aren't backdoored.) Unfortunately, we have no way to validate that the NSA did not grind the "seed" used to generate their parameters to search for curves which were strong or weak against some publicly unknown property which is only found in candidate curves at a one in a billion level. This is a weakness in the methodology used to pick the parameters, somewhat lovingly mocked by the BADA55 curves: https://bada55.cr.yp.to/vr.html https://bada55.cr.yp.to/vr.html It's not unreasonable for people to be concerned about this. Injecting intentional weaknesses into cryptosystems used by others was a fundamental objective for the NSA, which drove programs as significant as the CIA literally purchasing the at-the-time world largest manufacturer of encipher machines in order to ensure that it continued ship NSA designed intentionally weakened systems for decades ( https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ https://www.washingtonpost.com/graphics/2020/world/national-... ). That was, of course, somewhat before the establishment of the relevant ECC standards-- but the cloud of operational secrecy prevents us from knowing that much about what NSA has been up to more recently. The curve used in Bitcoin though isn't a NIST curve, and its generation procedure is about as close as you can get to rigid parameters without having rigid parameters as an explicit design goal. a=0 (required for the endomorphism), field is 3 mod 4 for fast sqrt, increment field from 2^256-2^32-1024 (fast limb structure) until you find a prime field with a non-trivial cube root of unity (required for endomorphism) and until you can obtain a curve with prime order, set B to the lowest value that does. The result of that procedure is secp256k1. (you can actually drop some of the requirements above and still get the same parameters too, but I am pretty confident that this was their search criteria) -- so no high entropy "random" inputs.
- tptacek 5y ago
  We can go back and forth on this. I don't agree with you about the P-curves, you will make well-constructed rebuttals to anything I say about this, we can reconstruct the thread from the search bar, let's not bother. I'd like to think we might be on the same page about Schneier and curves.
  - nullc 5y ago
    > I'd like to think we might be on the same page about Schneier and curves. Agreed. As I think we're both agreeing that it's a subject where well informed people could have a reasonable debate and disagreement, if you've got a reasonable link you'd suggest for the perspective you've taken it would be helpful to provide it (I provided the BADA55 curve page for that purpose)! (I could suggest one, but I'd prefer one you like!)
john_alan 5y ago
> The NIST P-curves aren't backdoored How can you assert this? Can you explain the coefficient choices?
- wolf550e 5y ago
  The argument is basically this: https://crypto.stackexchange.com/a/12917/24949 https://crypto.stackexchange.com/a/12917/24949

windsok 5y ago

It is curious that satoshi chose to use an uncommon, non-NIST curve for bitcoin. https://en.bitcoin.it/wiki/Secp256k1 https://en.bitcoin.it/wiki/Secp256k1

ashtonkem 5y ago
Satoshi in general appears to have been quite skeptical of the government, so it's not that surprising that they would not have trusted NIST curves.