3 ms·
He does a motte-and-bailey thing with the P-curves. I don't know if it's intentional or not. Curve25519 was a materially important engineering advance over the
by tptacek 1y ago
He does a motte-and-bailey thing with the P-curves. I don't know if it's intentional or not.
Curve25519 was a materially important engineering advance over the state of the art in P-curve implementations when it was introduced. There was a window of time within which Curve25519 foreclosed on Internet-exploitable vulnerabilities (and probably a somewhat longer period of time where it foreclosed on some embedded vulnerabilities). That window of time has pretty much closed now, but it was real at the time.
But he also does a handwavy thing about how the P-curves could have been backdoored. No practicing cryptgraphy engineer I'm aware of takes these arguments seriously, and to buy them you have to take Bernstein's side over people like Neil Koblitz.
The P-curve backdoor argument is unserious, but the P-curve implementation stuff has enough of a solid kernel to it that he can keep both arguments alive.
- cryptonector 1y agoQuite true, but the Dual_EC backdoor claim is serious. DJB's point that we should design curves with "nothing up my sleeve" is a nice touch.
- tptacek 1y agoSee, this gets you into trouble, because Bernstein has actually a pretty batshit take on nothing-up-my-sleeve constructions (see the B4D455 paper) --- and that argument also hurts his position on Kyber, which does NUMS stuff!
- cryptonector 1y agoLink?
- tptacek 1y agoI tried a couple searches and I forget which calculator-speak version of "BADASS" Bernstein actually used, but the concept of the paper† is that all the NUMS-style curves are suspect because you can make combinations of mathematical constants say whatever you want them to say (in combination), and so instead you should pick curve constants based purely on engineering excellence, which nobody could ever disagree about or (looks around the room) start huge conspiracy theories over. † as I remember it
- philodeon 1y agohttps://bada55.cr.yp.to/bada55-20150927.pdf https://bada55.cr.yp.to/bada55-20150927.pdf
- philodeon 1y agoThere’s also a more approachable set of slides on the topic at https://cr.yp.to/talks/2025.11.14/slides-djb-20251114-safecurves-4x3.pdf https://cr.yp.to/talks/2025.11.14/slides-djb-20251114-safecu...
- tptacek 1y agoWhat do you think of those slides?
- philodeon 1y agoI didn’t see anything “batshit” in either the paper or the slides.
- tptacek 1y agoSay more. What do you think of his argument? I paraphrased it downthread. Do you think I did so accurately? If not: what did I get wrong?
- philodeon 1y agoAt least in terms of the Bada55 paper, I think he writes in a fairly jocular style that sounds unprofessional unless you read his citations as well. You seem to object to his occasional jocularity and take it as prima facie evidence of him being “batshit”. Given that you are well known for a jocular writing style, perhaps you should extend some grace. The slides seem like a pretty nice summary of the 2015-era SafeCurves work, which you acknowledge elsewhere on this site (this thread? They all blend together) was based on good engineering.
- 1y ago