4 ms·

Yeah that's not my argument at all. My argument is specifically: "SHA3 implementations are necessary for Ed448, which increases code size and therefore also in

Yeah that's not my argument at all. My argument is specifically: "SHA3 implementations are necessary for Ed448, which increases code size and therefore also increases attack surface". The memory corruption bug was just a specific recent data point about the attack surface increase. The more meta point is "just add one more algorithm" isn't a free decision. It involves non-obvious trade-offs. I hope that makes it clearer.

tptacek 4y ago
Oh, I follow the argument, I just don't think it's persuasive. You wouldn't look at a system that deliberately built on SHA3 and say it was worse than a Blake2 scheme because of SHA3 code quality concerns, so I don't think it's a particularly compelling reason to pick a curve.
- some_furry 4y ago
  It's difficult to determine whether you follow an argument when you summarize it in a way that sounds incorrect. If that's an attempt at highlighting that what you summarized is not persuasive, your tactic also isn't very persuasive. Instead it comes across as snarky, dismissive, or that you misunderstood. It might be worth reconsidering this tactic. The main reason I wouldn't pick Ed448 is simpler: Nothing else really uses it.
  - tptacek 4y ago
    For what it's worth, I'm responding to this: There was a recent flurry of buffer overflows in SHA3 implementations. I'm aware of at least PHP being affected. Wanting Ed448 for political reasons, or purely for psychological comfort reasons, is a perfectly understandable stance to take as a non-expert. Unfortunately, the details that experts are privy to matter a ton, and severely outweigh any notions of having eggs in multiple baskets. We're open to having our risk calculus checked, but we're nearly unanimous on this one. Who's "we" here? I think Filippo has a mainstream take on the 448 curves, but I don't know that your take on SHA3 is widely shared.
    - some_furry 4y ago
      We here is people who don't advise using Ed448. It's tautology. You don't have to agree with the specific reason I cited. That isn't encapsulated by "we". I was providing an additional argument in case the mainstream take isn't sufficient. You cut the "To add to what Filippo said" part out of the excerpt you quoted, which was the necessary context to understand I was making an additional, supplementary argument.
      - tptacek 4y ago
        I don't agree with the specific reason you cited, which is what I wrote about.

tptacek 4y ago

Oh, I follow the argument, I just don't think it's persuasive. You wouldn't look at a system that deliberately built on SHA3 and say it was worse than a Blake2 scheme because of SHA3 code quality concerns, so I don't think it's a particularly compelling reason to pick a curve.

some_furry 4y ago
It's difficult to determine whether you follow an argument when you summarize it in a way that sounds incorrect. If that's an attempt at highlighting that what you summarized is not persuasive, your tactic also isn't very persuasive. Instead it comes across as snarky, dismissive, or that you misunderstood. It might be worth reconsidering this tactic. The main reason I wouldn't pick Ed448 is simpler: Nothing else really uses it.
- tptacek 4y ago
  For what it's worth, I'm responding to this: There was a recent flurry of buffer overflows in SHA3 implementations. I'm aware of at least PHP being affected. Wanting Ed448 for political reasons, or purely for psychological comfort reasons, is a perfectly understandable stance to take as a non-expert. Unfortunately, the details that experts are privy to matter a ton, and severely outweigh any notions of having eggs in multiple baskets. We're open to having our risk calculus checked, but we're nearly unanimous on this one. Who's "we" here? I think Filippo has a mainstream take on the 448 curves, but I don't know that your take on SHA3 is widely shared.
  - some_furry 4y ago
    We here is people who don't advise using Ed448. It's tautology. You don't have to agree with the specific reason I cited. That isn't encapsulated by "we". I was providing an additional argument in case the mainstream take isn't sufficient. You cut the "To add to what Filippo said" part out of the excerpt you quoted, which was the necessary context to understand I was making an additional, supplementary argument.
    - tptacek 4y ago
      I don't agree with the specific reason you cited, which is what I wrote about.