4 ms·

The r-curve parameters were apparently chosen by picking a random number, and hashing it, which somehow "proves" no nefarious play. Problem is that one could k

by matja 5y ago

The r-curve parameters were apparently chosen by picking a random number, and hashing it, which somehow "proves" no nefarious play. Problem is that one could keep picking random numbers, hashing them, to get curve parameters vulnerable to an attack not commonly known. There is no attempt to explain how these numbers were chosen, or to use a nothing-up-my-sleeve number. From "SEC 2: Recommended Elliptic Curve Domain Parameters": "... one type being parameters associated with a Koblitz curve and the other type being parameters chosen verifiably at random" "Verifiably random parameters offer some additional conservative features. These parameters are chosen from a seed using SHA-1 as specified in ANSI X9.62 [X9.62]. This process ensures that the parameters cannot be predetermined."

rocqua 5y ago
The trick here is to not use a random number as the input. Instead you pick some meaningful input. Say the string "secure random 256 bit curve parameters". You then hash that meaningful string to get a random number that is much harder to manipulate by brute force. Parameters generated this way are called "nothing up your sleeve" numbers.
- sgtnoodle 5y ago
  Couldn't you generate an arbitrarily large number of variations of vaguely human meaningful sentences, until one of them ended up with a convenient hash? The sentence you wrote as an example sounds like something an ML model would spit out. Yesterday I texted my coworker a suggestion to dockerize his yocto build so that it would work better in vagrant on a lambda server in the cloud. It's borderline these days, but he realized I was being facetious. He retorted with a serious comment about 500 lines of typescript to run 5 lines of bash.
  - kadoban 5y ago
    You could, theoretically, yes. Ideally it should be short and low entropy and you're a bit relying on laws of big numbers and a small amount of trust. "aes" is better than "aes is the best!" which is better than "aes123884586314745"
  - lupire 5y ago
    There are a lot more 1024-bit primes than plausible sentences.
  - mattalex 5y ago
    With "meaningful input" one usually means some prime number or the eg. first X digits of a constant like pi. (and if you chose a strange prime or constant, people would also ask questions) This generally narrows down the options to something were relatively little trickery is possible: keep in mind that the eg. hashes used to break some encryption would have to be very specific so that the algorithm isn't trivially broken to begin with. The more important part about nothing-up-my-sleeve is really the justification for choosing a particular hash/number. If, let's say your algorithm needs a prime with at least 10 digits and you pick the first prime with 10 digits nobody asks questions. If you picked the 16th, then people would ask questions. Similarly, if you can pick any arbitrary ten digit number and you pick the first 10 digits of pi, nobody will ask questions. If you picked the million'th to million-and-tenth digit of pi people would asks questions. "meaningful" has to be understood more as "from a pool of constants that leave little room for (mallicious) adjustment". The abstracter the number, the higher the potentially used searchspace.

by matja 5y ago

rocqua 5y ago

The trick here is to not use a random number as the input. Instead you pick some meaningful input. Say the string "secure random 256 bit curve parameters". You then hash that meaningful string to get a random number that is much harder to manipulate by brute force. Parameters generated this way are called "nothing up your sleeve" numbers.

sgtnoodle 5y ago
Couldn't you generate an arbitrarily large number of variations of vaguely human meaningful sentences, until one of them ended up with a convenient hash? The sentence you wrote as an example sounds like something an ML model would spit out. Yesterday I texted my coworker a suggestion to dockerize his yocto build so that it would work better in vagrant on a lambda server in the cloud. It's borderline these days, but he realized I was being facetious. He retorted with a serious comment about 500 lines of typescript to run 5 lines of bash.
- kadoban 5y ago
  You could, theoretically, yes. Ideally it should be short and low entropy and you're a bit relying on laws of big numbers and a small amount of trust. "aes" is better than "aes is the best!" which is better than "aes123884586314745"
- lupire 5y ago
  There are a lot more 1024-bit primes than plausible sentences.
- mattalex 5y ago
  With "meaningful input" one usually means some prime number or the eg. first X digits of a constant like pi. (and if you chose a strange prime or constant, people would also ask questions) This generally narrows down the options to something were relatively little trickery is possible: keep in mind that the eg. hashes used to break some encryption would have to be very specific so that the algorithm isn't trivially broken to begin with. The more important part about nothing-up-my-sleeve is really the justification for choosing a particular hash/number. If, let's say your algorithm needs a prime with at least 10 digits and you pick the first prime with 10 digits nobody asks questions. If you picked the 16th, then people would ask questions. Similarly, if you can pick any arbitrary ten digit number and you pick the first 10 digits of pi, nobody will ask questions. If you picked the million'th to million-and-tenth digit of pi people would asks questions. "meaningful" has to be understood more as "from a pool of constants that leave little room for (mallicious) adjustment". The abstracter the number, the higher the potentially used searchspace.