3 ms·

I wouldn't contest that no crypto engineer "seriously believes NIST P-curves are backdoored", but I know some high profile crypto engineers who seriously think

I wouldn't contest that no crypto engineer "seriously believes NIST P-curves are backdoored", but I know some high profile crypto engineers who seriously think and demonstrate how they might be flawed and could have been backdoored since day one. [1] [2] It's almost impossible to prove they were backdoored, but considering the sensitivity of the subject, I understand why many consider this unknown a reason to distrust NIST P-curves. [1] https://cr.yp.to/talks/2013.05.31/slides-dan%2Btanja-20130531-4x3.pdf https://cr.yp.to/talks/2013.05.31/slides-dan%2Btanja-2013053... [2] https://cr.yp.to/newelliptic/nistecc-20160106.pdf https://cr.yp.to/newelliptic/nistecc-20160106.pdf

unscaled 5y ago
Backdoored or not, the P-curves (or more specifically the standard algorithm we use for them) are hard to use and easy to misuse. djb dedicated an entire page listing all the theoretical issues with the P-curves and other elliptic curves[1], but their main weakness in practice is that they are just too prone to bad implementation and misuse. The most well-known failure has to be the PS3 jailbreak [2]. Sony just failed to implement their RNG (or alternatively copied their RNG code from xkcd #221), which rendered their ECDSA-based crypto completely worthless. Another famous case is the long list of JWT/JWE libraries which were vulnerable to invalid curve attacks, again completely destroying the security of their NIST p-curves (when used for encryption) [3]. Really, I don't think nobody should be using NIST P-curves if they have any choice, unless you verified your implementation yourself. And I don't even want to claim to be able to do it. (I don't think tptacek ever said you should use the NIST curves[4], so there's no controversy there) [1] https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/ [2] https://www.youtube.com/watch?v=LP1t_pzxKyE https://www.youtube.com/watch?v=LP1t_pzxKyE [3] https://auth0.com/blog/critical-vulnerability-in-json-web-encryption/ https://auth0.com/blog/critical-vulnerability-in-json-web-en... [4] https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html#asymmetric-encryption https://latacora.micro.blog/2018/04/03/cryptographic-right-a...
tptacek 5y ago
Dan Bernstein wrote a paper everyone refers to as BADA55 which essentially suggests that virtually every curve in common use other than his are potentially backdoored, even if they're derived from fundamental mathematical constants (in fact, demonstrating that possibility is the point of the paper). So I'd be careful about using Bernstein as a load-bearing citation for this argument. Again: Koblitz and Menezes take up this topic in detail.

unscaled 5y ago

Backdoored or not, the P-curves (or more specifically the standard algorithm we use for them) are hard to use and easy to misuse. djb dedicated an entire page listing all the theoretical issues with the P-curves and other elliptic curves[1], but their main weakness in practice is that they are just too prone to bad implementation and misuse. The most well-known failure has to be the PS3 jailbreak [2]. Sony just failed to implement their RNG (or alternatively copied their RNG code from xkcd #221), which rendered their ECDSA-based crypto completely worthless. Another famous case is the long list of JWT/JWE libraries which were vulnerable to invalid curve attacks, again completely destroying the security of their NIST p-curves (when used for encryption) [3]. Really, I don't think nobody should be using NIST P-curves if they have any choice, unless you verified your implementation yourself. And I don't even want to claim to be able to do it. (I don't think tptacek ever said you should use the NIST curves[4], so there's no controversy there) [1] https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/ [2] https://www.youtube.com/watch?v=LP1t_pzxKyE https://www.youtube.com/watch?v=LP1t_pzxKyE [3] https://auth0.com/blog/critical-vulnerability-in-json-web-encryption/ https://auth0.com/blog/critical-vulnerability-in-json-web-en... [4] https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html#asymmetric-encryption https://latacora.micro.blog/2018/04/03/cryptographic-right-a...

tptacek 5y ago

Dan Bernstein wrote a paper everyone refers to as BADA55 which essentially suggests that virtually every curve in common use other than his are potentially backdoored, even if they're derived from fundamental mathematical constants (in fact, demonstrating that possibility is the point of the paper). So I'd be careful about using Bernstein as a load-bearing citation for this argument. Again: Koblitz and Menezes take up this topic in detail.