3 ms·

> "However, they gave no evidence of a back door, and in the two decades since that time no one has found a way that a back door could be inserted in DSA (or EC

by dhx 3y ago

> "However, they gave no evidence of a back door, and in the two decades since that time no one has found a way that a back door could be inserted in DSA (or ECDSA)." ElGamal/DSA is fragile and difficult to implement securely in a way that doesn't reveal secret k. ECC (and somewhat particularly NIST curves[1]) is also very difficult to implement securely from side channel attacks[2]. Consideration of "backdoors" should be broader than just mathematical equations on paper. "backdoors" could also include deliberate choice of algorithm or parameters that are fragile and difficult to implement in a secure way to minimise risk of side channel leakage of secrets. This is especially important in a whole variety of applications such as passports, payment cards and TPMs. [1] https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf#page=23 https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf#p... [2] Specifically, implementation of: https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplic...

less_less 3y ago
> ElGamal/DSA is fragile and difficult to implement securely in a way that doesn't reveal secret k. ECC (and somewhat particularly NIST curves[1]) is also very difficult to implement securely from side channel attacks[2]. IMHO this isn't evidence of a backdoor. Side-channel protection is hard. RSA decryption and especially keygen are also tricky to implement in a side-channel-protected way, and a widespread timing attack on RSA decryption in many libraries was published earlier this year [3]. The NIST p-curves used the state-of-the-art elliptic curve shape for general operations when they were released: short Weierstrass curves over prime fields. Edwards curves are easier to defend against side channels and are overall a better choice (with their own rough edges, mostly involving the cofactor), but those were not known until 2007. Montgomery curves (similar rough edges to Edwards, plus the point at infinity) were known earlier and are nice for key exchange, but they are not as nice for signatures. Overall I would not choose the NIST curves for a new design today, because Edwards/Montgomery curves are a better choice. But I think the evidence they were backdoored (mathematically or otherwise) is weak. [3] https://people.redhat.com/~hkario/marvin https://people.redhat.com/~hkario/marvin
- Ar-Curunir 3y ago
  There are now fairly efficient complete formulae for prime-order curves, so the case for the NIST curves is stronger.
Ar-Curunir 3y ago
The only reason DSA is used is because the natural signature scheme was patented (Schnorr).

by dhx 3y ago

less_less 3y ago

> ElGamal/DSA is fragile and difficult to implement securely in a way that doesn't reveal secret k. ECC (and somewhat particularly NIST curves[1]) is also very difficult to implement securely from side channel attacks[2]. IMHO this isn't evidence of a backdoor. Side-channel protection is hard. RSA decryption and especially keygen are also tricky to implement in a side-channel-protected way, and a widespread timing attack on RSA decryption in many libraries was published earlier this year [3]. The NIST p-curves used the state-of-the-art elliptic curve shape for general operations when they were released: short Weierstrass curves over prime fields. Edwards curves are easier to defend against side channels and are overall a better choice (with their own rough edges, mostly involving the cofactor), but those were not known until 2007. Montgomery curves (similar rough edges to Edwards, plus the point at infinity) were known earlier and are nice for key exchange, but they are not as nice for signatures. Overall I would not choose the NIST curves for a new design today, because Edwards/Montgomery curves are a better choice. But I think the evidence they were backdoored (mathematically or otherwise) is weak. [3] https://people.redhat.com/~hkario/marvin https://people.redhat.com/~hkario/marvin

Ar-Curunir 3y ago
There are now fairly efficient complete formulae for prime-order curves, so the case for the NIST curves is stronger.

Ar-Curunir 3y ago

The only reason DSA is used is because the natural signature scheme was patented (Schnorr).