Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

keymaterial.net

Post reply on HN
Print view View original

11–20 of 67 posts

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#11

Post by bawolff »

cgio wrote: post #2

The logical click bait on this one. I could not resist thinking it’s like saying there is no circle other than a round circle, but I had no idea if it’s equivalent and fair comment given my limited cryptography knowledge (as in non existent). So I had to read it, and while I got little, by osmosis, I feel falling for the bait was worth it.

For historical context, TLS only really started to use the eliptic curve version of diffie-helman in the mid 2010s. Prior to that, plain diffie helman was more popular. (E.g. here is a thread from a decade ago complaining about lack of support https://security.stackexchange.com/questions/59459/how-widel... ).

ECC also used to have patents which restricted adoption back in the day.

There also used to be a lot of conspiracy theories that NSA backdoored nist curved ( e.g. https://m.slashdot.org/story/191445 ). Probably fud, but it slowed down adoption of eliptic curves.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#13

Post by tgma »

bawolff wrote: post #11
cgio wrote: post #2

The logical click bait on this one. I could not resist thinking it’s like saying there is no circle other than a round circle, but I had no idea if it’s equivalent and fair comment given my limited cryptography knowledge (as in non existent). So I had to read it, and while I got little, by osmosis, I feel falling for the bait was worth it.

For historical context, TLS only really started to use the eliptic curve version of diffie-helman in the mid 2010s. Prior to that, plain diffie helman was more popular. (E.g. here is a thread from a decade ago complaining about lack of support https://security.stackexchange.com/questions/59459/how-widel... ). ECC also used to have patents which restricted adoption back in the day. There also used to be a lot of consp…

I believe the patent issue was by far the dominant friction for adoption in 2000s. On the NIST curve problem, well, maybe FUD, but evidently, they indeed backdoored the elliptic curve-based random number generator, so I would say some distrust is warranted.

Irrespective of the curve issue, ed25519/x25519 is superior and has other nice properties like not catastrophically breaking if you can't generate a unique random "k" for ECDSA as PlayStation discovered the hard way[1].

[1]: https://youtu.be/DUGGJpn2_zY?t=2142

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#14

Post by phkahler »

bawolff wrote: post #11
cgio wrote: post #2

The logical click bait on this one. I could not resist thinking it’s like saying there is no circle other than a round circle, but I had no idea if it’s equivalent and fair comment given my limited cryptography knowledge (as in non existent). So I had to read it, and while I got little, by osmosis, I feel falling for the bait was worth it.

For historical context, TLS only really started to use the eliptic curve version of diffie-helman in the mid 2010s. Prior to that, plain diffie helman was more popular. (E.g. here is a thread from a decade ago complaining about lack of support https://security.stackexchange.com/questions/59459/how-widel... ). ECC also used to have patents which restricted adoption back in the day. There also used to be a lot of consp…

>> Probably fud, but it slowed down adoption of eliptic curves.

Not FUD at all. NIST revoked their recommendation to use those curves because of it. The facts are that a "backdoor" exists whether anyone knows what it is or not, and NSA could not explain how those particular numbers were chosen so out of caution we must assume they know the backdoor and not use those curves.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#15

Post by tgma »

phkahler wrote: post #14
bawolff wrote: post #11

Earlier quoted context omitted.

For historical context, TLS only really started to use the eliptic curve version of diffie-helman in the mid 2010s. Prior to that, plain diffie helman was more popular. (E.g. here is a thread from a decade ago complaining about lack of support https://security.stackexchange.com/questions/59459/how-widel... ). ECC also used to have patents which restricted adoption back in the day. There also used to be a lot of consp…

>> Probably fud, but it slowed down adoption of eliptic curves. Not FUD at all. NIST revoked their recommendation to use those curves because of it. The facts are that a "backdoor" exists whether anyone knows what it is or not, and NSA could not explain how those particular numbers were chosen so out of caution we must assume they know the backdoor and not use those curves.

I believe you are mixing up NIST ECC curves with Dual_EC_DRBG[1] which is a random number generator based on elliptic curves which is widely considered to be backdoored and they revoked its recommendation (there are much better ways to construct an RNG so it was stupid to use in practice for reasons other than backdoor too.)

The P-series curves are still a NIST recommendation and widely deployed in TLS. The B-series fell out of fashion due to practical reasons.

[1]: https://en.wikipedia.org/wiki/Dual_EC_DRBG

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#16

Post by vitalnodo »

Just wondering — has anyone come across a course or resource that explores how cryptographic systems are built up from smaller building blocks?

Like, using something like SageMath for algebraic structures, a prover like Lean to verify properties — to get a feel for how things actually fit together.

There's something cool about trying to reimplement known standards just to understand them better (with the usual "don’t roll your own crypto" warning, of course). By the way, it would be nice to have a kind of sandbox for the more formal path to explore how to build my own SP-network, prove that the Decisional Diffie-Hellman assumption holds or something.

I've seen cryptopals and cryptohack.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#17

Post by moi2388 »

vitalnodo wrote: post #16

Just wondering — has anyone come across a course or resource that explores how cryptographic systems are built up from smaller building blocks? Like, using something like SageMath for algebraic structures, a prover like Lean to verify properties — to get a feel for how things actually fit together. There's something cool about trying to reimplement known standards just to understand them better (with the usual "don’t…

That’d indeed be nice to do.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#19

Post by thaumasiotes »

jhanschoo wrote: post #18

The author seems to be a busy person, but I would appreciate it if they would consider modifying their blog publishing software so that the math and definitions could be rendered in text and KaTeX instead of raster images.

What would that help with?

I know KaTeX supposedly lets you copy-and-paste the text, but that won't get you text that is fit for any purpose.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#20

Post by willvarfar »

thaumasiotes wrote: post #19
jhanschoo wrote: post #18

The author seems to be a busy person, but I would appreciate it if they would consider modifying their blog publishing software so that the math and definitions could be rendered in text and KaTeX instead of raster images.

What would that help with? I know KaTeX supposedly lets you copy-and-paste the text, but that won't get you text that is fit for any purpose.

(hopefully modern screen reading software is clever enough to OCR and summarise images as it does text.

And if not, then that seems to be something that is now within reach of modern AI and just needs application.)

Post reply on HN