4 ms·
As djb pointed out in "Security dangers of the NIST curves", SHA-1 does not prove much. If NSA knows a weak class of curves, they try as many strings as they wa
by sanxiyn 13y ago
As djb pointed out in "Security dangers of the NIST curves", SHA-1 does not prove much. If NSA knows a weak class of curves, they try as many strings as they want until SHA-1 of the string hits a weak curve.
- tptacek 13y agoIt doesn't prove much; you can always just generate a new P-256-alike with the instructions NIST provided for you in that document.
- acqq 13y agoWho can generate? Aren't the values fixed by the standards, mustn't both client and servers use the same as long as they support the given standard?
- tptacek 13y agoThe standard provides a standard set of curve parameters and a NIST-sanctioned way of generating new curve parameters using the exact same method.
- acqq 13y agoHow can be any other parameters than the standard ones used in the current browsers and servers? I think they can't, am I right? And how can browsers start to use any other parameters before they standardise them? I think they can't?
- tptacek 13y agoThis is true but not particularly meaningful to me, because you can't really do anything new with crypto at all without some kind of software update. For instance, the primes and generator for conventional number theoretic DH are also pre-generated and baked into a standard.
- cryptbe 13y agoSo maybe we should generate our own curves. I propose something as follows: 1. Locate a public string. A tweet or a quote should suffice. 2. SHA-512 the string to obtain a seed. 3. Use that seed to generate b, and calculate N = #E(Fp) = n * h, and choose a base point P. Of course we need to ensure that these parameters are safe against known attacks. 4. Mandate that the new set of parameters MUST be supported wherever NIST prime curves are supported. The last step is probably the most difficult. You don't need that if you don't need to interoperate with other implementations though.
- tptacek 13y agoThe only thing you want not to happen is for software to start generating and negotiating its own curves, because that then requires all interoperable implementations to parse and validate random curves from attackers.
- cryptbe 13y agoNo, I didn't say that everyone generates their own curves. I meant the security community should generate our own curves. Somebody should email Thomas Pornin.
- tptacek 13y agoSorry, I didn't mean to imply you were saying that.
- pbsd 13y agoThere are already several alternative curve sets, satisfying various degrees of paranoia: - http://certivox.org/display/EXT/CertiVox+Standard+Curves http://certivox.org/display/EXT/CertiVox+Standard+Curves - http://tools.ietf.org/html/rfc5639 http://tools.ietf.org/html/rfc5639 - curve25519 and the other djb et al curves.