4 ms·
If you're referring to the recent FLUSH+RELOAD attacks, that is hardly ECC-specific. They also owned GnuPG's RSA earlier with the same technique [1]. On the oth
by pbsd 13y ago
If you're referring to the recent FLUSH+RELOAD attacks, that is hardly ECC-specific. They also owned GnuPG's RSA earlier with the same technique [1]. On the other hand, if your argument is that ECC implementations are generally less mature, I can't disagree with that. I believe that ECC (using Edwards or Montgomery forms; debatable when using general Weierstrass form) is easier to get right with respect to solid implementations than RSA is.
With respect to theoretical attacks, it is of course impossible to know what the future brings. But as long as we're sticking with conservative prime fields, I think it's probably either going to be fine or all of ECC is dead. It's also not like integer factorization or discrete logs have reached some kind of complexity lower bound; it's certainly not impossible that we'll get a L(1/4) method in the future as well. I look forward to see how it plays out.
[1] http://eprint.iacr.org/2013/448 http://eprint.iacr.org/2013/448
- tptacek 13y agoSince part of his argument is that it's especially easy to stumble into timing leaks with ECC implementations, it seems fair for him to call out OpenSSL's secp256k1 implementation.
- cperciva 13y agoIt's also not like integer factorization or discrete logs have reached some kind of complexity lower bound; it's certainly not impossible that we'll get a L(1/4) method in the future as well. Not impossible, no. But the fact that people have spent much longer looking for improved integer factorization attacks without making progress makes me more optimistic that integer factorization will continue to hold up to further scrutiny.