5 ms·
The article basically says that Satoshi went for secp256k1 because for secp256r1 the constants were defined by the NIST under the possible influence of the NSA.
by janmo 5y ago
The article basically says that Satoshi went for secp256k1 because for secp256r1 the constants were defined by the NIST under the possible influence of the NSA.
I don't think it is a good argument, I invite every one to take a look at the DES S-Box constants.
Many people believed that those were backdoor constants that the NSA planted into the algorithm as there was no explanation on how and why they were chosen.
Many years later it turned out that they were picked carefully to protect against differential-linear attacks. An attack only the NSA knew back then.
So they gave out safe S-Box constants, and all those who distrusted them and picked random/other S-Boxes were actually screwed, this is really ironic.
https://en.wikipedia.org/wiki/S-box https://en.wikipedia.org/wiki/S-box
- dan-robertson 5y agoRight except on the other hand, look at the whole Dual_EC_DRBG fiasco where the NSA gave instructions for how one could pick parameters, but also offered their own suggestion (in some standards, one had to use the suggested parameters.) The bit about choosing parameters suggests that the NSA didn’t have a benevolent reason to choose those parameters, and the evidence of that algorithm being exploited in the wild suggests that the NSA may have chosen their parameters with that exploit in mind.
- janmo 5y agoThe way the Dual_EC_DRBG backdoor worked is that only they (the NSA) could exploit it, they had the equivalent of a master private key. The NSA has a track record of never putting out Cryptography that could be broken by any other actor than the NSA itself.
- hutzlibu 5y ago"of never putting out Cryptography that could be broken by any other actor than the NSA itself. " If the only obstacle for others is "unknown Math" - then surely you can rule the script kiddies out, but I believe there are quite some other clever people with strong Math background around, who do not work exclusively for the NSA.
- dan-robertson 5y agoThe Dual_EC exploit was possible not because the NSA were cleverer than everyone else but because they wrote the standard and chose the parameters. The parameters involved two points, P and Q, on an elliptic curve group with rank 1 and prime order. Because of these properties there must be some number e such that P = Q^e (written P = e * Q in the common elliptic curve group notation) but it is hard to find e from only P and Q (this is the discrete log problem for this EC group and it, or its close relative the Diffie–Hellman, problem being hard is a common foundation for security in cryptography.) However if you are choosing the parameters, you can just choose Q and e and compute P = Q^e yourself.
- dan-robertson 5y agoThe Juniper hack (where their firewall product had a backdoor injected) was enabled by someone breaking into the company and modifying the parameters for Dual_EC_DRBG. It was sufficient for the algorithm to allow for a backdoor for there to be problems. Presumably it would have been caught sooner had the hack required a backdoor to be hidden in the source code and not some bytes that looked like a magic constant.
- ryanlol 5y agoDual_EC_DRBG is bad because someone with access to Junipers source repos was able to backdoor their implementation? Do you realise how preposterous that sounds? > Presumably it would have been caught sooner had the hack required a backdoor to be hidden in the source code and not some bytes that looked like a magic constant. Have you seen what real life bugdoors look like?
- sillysaurusx 5y ago… but that’s exactly the reason Satoshi distrusted the NSA. All else being equal, what possible incentive is there to design Bitcoin in a way that might theoretically be vulnerable to the NSA?
- uap 5y agoLots of money? If you can short cut mining, it's cleaner black money than dealing drugs or people, probably. And if you can steal from someone else's address, maybe that's even better... You can seize funds with no red tape. Or mete out that capability to allies etc. Why wouldn't the NSA want to support a parallel financial system that criminals flock to? Just like why wouldn't the NSA want to covertly support encrypted messaging apps or the FBI do that...
- tinus_hn 5y agoIf the Bitcoin ecosystem is broken like that, the coins are worthless. You can use an attack like that only once.
- spoonjim 5y agoThere is no such thing. Russia and China have state mathematical capabilities just as good as the US has.
- dan-robertson 5y agoIf the standard is that you attach a copy of your message encrypted with an NSA-provided public key, and only the NSA has access to the private key, then being good at math won’t help Russia or China. Obviously the NSA couldn’t get people to use such a standard but they managed to slip something like that into Dual_EC and had success in getting people to use it.
- SV_BubbleTime 5y agoThe right thing to do then was to disclose the attack, explain their choices, and further cryptography. Instead they seemingly wanted to exploit anyone who didn’t use their constants, I guess?
- janmo 5y agoThis was during the cold war. They didn't wanted the soviets to know, but apparently they already knew the attack as well.
- SV_BubbleTime 5y agoThanks for the context. I’m still pessimistic about them as unelected ultra powerful blameless immortal all seeing eyes - but I get that good people might make the same decisions with the same info.
- ethanbond 5y agoUh, their job isn’t to “further cryptography”. It’s to further America’s interests.
- lupire 5y agoWell, advance their chosen clients' interests.
- matja 5y agoThe r-curve parameters were apparently chosen by picking a random number, and hashing it, which somehow "proves" no nefarious play. Problem is that one could keep picking random numbers, hashing them, to get curve parameters vulnerable to an attack not commonly known. There is no attempt to explain how these numbers were chosen, or to use a nothing-up-my-sleeve number. From "SEC 2: Recommended Elliptic Curve Domain Parameters": "... one type being parameters associated with a Koblitz curve and the other type being parameters chosen verifiably at random" "Verifiably random parameters offer some additional conservative features. These parameters are chosen from a seed using SHA-1 as specified in ANSI X9.62 [X9.62]. This process ensures that the parameters cannot be predetermined."
- rocqua 5y agoThe trick here is to not use a random number as the input. Instead you pick some meaningful input. Say the string "secure random 256 bit curve parameters". You then hash that meaningful string to get a random number that is much harder to manipulate by brute force. Parameters generated this way are called "nothing up your sleeve" numbers.
- sgtnoodle 5y agoCouldn't you generate an arbitrarily large number of variations of vaguely human meaningful sentences, until one of them ended up with a convenient hash? The sentence you wrote as an example sounds like something an ML model would spit out. Yesterday I texted my coworker a suggestion to dockerize his yocto build so that it would work better in vagrant on a lambda server in the cloud. It's borderline these days, but he realized I was being facetious. He retorted with a serious comment about 500 lines of typescript to run 5 lines of bash.
- kadoban 5y agoYou could, theoretically, yes. Ideally it should be short and low entropy and you're a bit relying on laws of big numbers and a small amount of trust. "aes" is better than "aes is the best!" which is better than "aes123884586314745"
- egberts1 5y agowith a precomputed value comes with an enormous “strain”bow table.