Why we don’t generate elliptic curves every day • Hacker News Board

Re: Why we don’t generate elliptic curves every day

#51

Post by nmadden » Thu, Oct 26, 2023, 2:11 PM UTC

tptacek wrote: post #49

tptacek wrote: post #23

Earlier quoted context omitted.

I agree with you, and am reassured by cryptosystems that use 25519 and put on edge by those that use the P-curves (not because of backdoor conspiracy theories, which are silly, but because the P-curves are easy to mess up). But cryptography engineers increasingly disagree with me.

(oh, also: yes, that's my understanding too, that you're still stuck validating incoming curve points in ECDH, but I think the anti-cofactor people have a corresponding argument for signature schemes.)

Yeah, and that’s totally reasonable. I’m one of those people that thinks signatures should be used for software updates and nothing else though.

Re: Why we don’t generate elliptic curves every day

#52

Post by tptacek » Thu, Oct 26, 2023, 3:29 PM UTC

nmadden wrote: post #51

tptacek wrote: post #49

Earlier quoted context omitted.

(oh, also: yes, that's my understanding too, that you're still stuck validating incoming curve points in ECDH, but I think the anti-cofactor people have a corresponding argument for signature schemes.)

Yeah, and that’s totally reasonable. I’m one of those people that thinks signatures should be used for software updates and nothing else though.

Yes, my brain sort of shuts off and buckets signature cryptography into cryptocurrency, which is where the cofactor issues crop up anyways.

Re: Why we don’t generate elliptic curves every day

#53

Post by euicnon » Sun, Oct 29, 2023, 10:06 AM UTC

hyper_reality wrote: post #34

euicnon wrote: post #30

Are there cryptographers with dissenting opinions to this article, or is what the author writes about generally recognised best practice? I ask because I remember an article a while back where this same author had very confidently got some details wrong about CloudFlare and I think the CEO or CTO or someone like that had to step in and correct him.

Are you sure you're thinking of the right author? Filippo used to work at Cloudflare so I can't imagine he got the technical details about it too wrong.

Yes, definitely. It was this comment chain on an HN post: https://news.ycombinator.com/item?id=33573477

Re: Why we don’t generate elliptic curves every day

#54

Post by phkahler » Mon, Oct 30, 2023, 1:35 PM UTC

tptacek wrote: post #12

phkahler wrote: post #7

The author never addresses the issue of trusting standard parameters. I agree with them on the rest, but standard parameters need evidence that they were not specially selected for reasons unknown to everyone else.

You're never going to get a satisfactory answer. The world's foremost proponent of not trusting standardized parameters wrote and repeatedly submitted a paper demonstrating a model attack that targeted curves built from mathematical constants; when you've "backdoored pi", there's really no place to go from there. That author's subtext, as I understood it, was that curves should be selected by functional optimization;…

>> The world's foremost proponent of not trusting standardized parameters wrote and repeatedly submitted a paper demonstrating a model attack that targeted curves built from mathematical constants; when you've "backdoored pi", there's really no place to go from there.

That sounds like an argument against standard parameters. Even if we trust an algorithm, we can't trust others to choose parameters for them? The solution seems obvious - find a better way to choose (non-standard) parameters.