4 ms·

Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give

by gleenn 5y ago

Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give that impression, wanted to check though.

JCBird1012 5y ago
A backdoor in Curve25519 hasn’t really been a concern, because unlike P-256, the parameters for the curve didn’t come from NIST. Curve25519 is a djb (https://en.wikipedia.org/wiki/Daniel_J._Bernstein https://en.wikipedia.org/wiki/Daniel_J._Bernstein) special. So unless djb was secretly working with the NSA and willing to risk his reputation to backdoor a highly scrutinized elliptic curve, the risk is low.
- sudosysgen 5y ago
  The issue is that RSA isn't backdorable, while elliptic curves are. Even if we trust the author, it's better not to trust anyone.
- a1369209993 5y ago
  More importantly (because that's definitely something the NSA would try to do), curve25519 has fewer degrees of freedom to hide a backdoor in than P-256; 2^255-19 is the largest uint255 that's prime, and the other parameters (mostly the coefficent A=486662) were chosen by a similar "first value that satisified the security requirements" process - there's a paper by DJB explaining the parameter selection rationale around somewhere[0], although they could definitely stand to be more conspicuous about it. 0: The value of A is (poorly) explained in passing in https://cr.yp.to/ecdh/curve25519-20060209.pdf https://cr.yp.to/ecdh/curve25519-20060209.pdf under heading "Why this curve?", but that doesn't explain any details for someone who's not a cryptographer.
- marcosdumay 5y ago
  I believe that the thing is more that DJB created that huge paper about how to create a curve so that everybody can know it's not backdoored, with advice that appears to be almost unanimous, and created Curve25519 by following it. It's not a matter of trusting him, instead, it's a matter of using the algorithm that requires less trust of them all (including RSA).
deleted 5y ago
[deleted]
woodruffw 5y ago
There's no particular evidence that the NSA has backdoored P-256 or any other cipher in Suite B. Suite B is considered suitable for protecting compartmentalized classified information, so it would be actively dangerous for the NSA to attempt to backdoor it. The closest thing to evidence of a backdoor is circumstantial: P-256 and the others use seeds that have never been fully explained. But this alone isn't particularly unusual: DES's S-boxes were similarly chosen opaquely, and we now know that the NSA did this to strengthen DES against the not-yet-public technique of differential cryptanalysis. All that being said, Curve25519 (and Ed25519) is just better, and you should prefer it whenever you can[1]. [1]: https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/

by gleenn 5y ago

JCBird1012 5y ago

A backdoor in Curve25519 hasn’t really been a concern, because unlike P-256, the parameters for the curve didn’t come from NIST. Curve25519 is a djb (https://en.wikipedia.org/wiki/Daniel_J._Bernstein https://en.wikipedia.org/wiki/Daniel_J._Bernstein) special. So unless djb was secretly working with the NSA and willing to risk his reputation to backdoor a highly scrutinized elliptic curve, the risk is low.

sudosysgen 5y ago
The issue is that RSA isn't backdorable, while elliptic curves are. Even if we trust the author, it's better not to trust anyone.
a1369209993 5y ago
More importantly (because that's definitely something the NSA would try to do), curve25519 has fewer degrees of freedom to hide a backdoor in than P-256; 2^255-19 is the largest uint255 that's prime, and the other parameters (mostly the coefficent A=486662) were chosen by a similar "first value that satisified the security requirements" process - there's a paper by DJB explaining the parameter selection rationale around somewhere[0], although they could definitely stand to be more conspicuous about it. 0: The value of A is (poorly) explained in passing in https://cr.yp.to/ecdh/curve25519-20060209.pdf https://cr.yp.to/ecdh/curve25519-20060209.pdf under heading "Why this curve?", but that doesn't explain any details for someone who's not a cryptographer.
marcosdumay 5y ago
I believe that the thing is more that DJB created that huge paper about how to create a curve so that everybody can know it's not backdoored, with advice that appears to be almost unanimous, and created Curve25519 by following it. It's not a matter of trusting him, instead, it's a matter of using the algorithm that requires less trust of them all (including RSA).

deleted 5y ago

[deleted]

woodruffw 5y ago

There's no particular evidence that the NSA has backdoored P-256 or any other cipher in Suite B. Suite B is considered suitable for protecting compartmentalized classified information, so it would be actively dangerous for the NSA to attempt to backdoor it. The closest thing to evidence of a backdoor is circumstantial: P-256 and the others use seeds that have never been fully explained. But this alone isn't particularly unusual: DES's S-boxes were similarly chosen opaquely, and we now know that the NSA did this to strengthen DES against the not-yet-public technique of differential cryptanalysis. All that being said, Curve25519 (and Ed25519) is just better, and you should prefer it whenever you can[1]. [1]: https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/