4 ms·
ARGH NO ARGH. First, conventional DLP systems also have suspect parameters. Which parameters are those? For a classic DH run, there are just two parameters: a
by geertj 13y ago
ARGH NO ARGH. First, conventional DLP systems also have suspect parameters.
Which parameters are those? For a classic DH run, there are just two parameters: a prime p, and a generator g. Normally you generate these yourself. Any safe prime is good as a p, and g is usually 2 or 5.
Contrast this to ECC where generation of parameters (the "curve") is so complex that you never do this yourself. You use one of the published curves, for example the ones specified by NIST.
So, I can't judge if ECC was "tweaked" by the NSA or not, but the original statement is true that ECC contains more "magic numbers" than DH, which contains none.
- saratogacx 13y agoI believe the point is that with the magic numbers provided by the NIST you are trusting that those numbers have no side effects that decrease the content that you're encrypting to the party that decided on producing those numbers in the specification. (tin foil speculation) It isn't known if the NSA already has methods that, with this specified set, is more easily broken or is already broken.
- tptacek 13y agoSystems that generate their own DH parameters have to negotiate them, which adds mechanism and thus potential vulnerabilities. NIST publishes standard groups for systems to use to avoid that problem. I'm certainly not claiming that conventional DLP is more complicated than ECC, though.
- pbsd 13y agoDoes NIST actually publish standard DL groups? All I have seen is instructions on how to generate them, i.e., SP800-56A. NIST publishes standard curves because the instruction list to generate them would require describing Schoof's algorithm to count points, among other things.