Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safe curves for Elliptic Curve Cryptography [pdf]

eprint.iacr.org

Post reply on HN
Print view View original

21–30 of 76 posts

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#21

Post by api »

mike_hearn wrote: post #7

The naming is unfortunate. Some people (Ubuntu...) have concluded that because some curves are branded "safe" that must mean all the other curves are therefore "unsafe" and must be aggressively phased out as if they were MD5. They're changing apt to refuse to download from repositories signed using NIST curves, for instance. This doesn't make a whole lot of sense unless you think the NSA have an unknown backdoor that…

Infosec suffers from a huge cargo cult and mindless sticky meme problem because so few people actually understand it.

There are still admins who block all ICMP because of the “ping of death,” a Windows bug from either the late 1990s or 2000s. They don’t know this though. They just heard that ICMP is “dangerous.”

People also don’t use IPv6 because they think NAT is a security feature.

I guess it’s similar to baseless health fears and happens whenever people don’t really understand a domain. You get a proliferation of lore that is just repeated.

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#23

Post by api »

Y_Y wrote: post #11
mike_hearn wrote: post #7

The naming is unfortunate. Some people (Ubuntu...) have concluded that because some curves are branded "safe" that must mean all the other curves are therefore "unsafe" and must be aggressively phased out as if they were MD5. They're changing apt to refuse to download from repositories signed using NIST curves, for instance. This doesn't make a whole lot of sense unless you think the NSA have an unknown backdoor that…

> unless you think the NSA have an unknown backdoor that nobody was able to find Your post names sense to me, but I don't think it's too crazy to allow for the possibility that e.g. the NSA has backdoored some of the "recommended" crypto constants in current use.

There’s a strong argument against back doors of this type in ECC.

To back door the NIST curves would require that the NSA knows a secret attack against ECC and used brute force search to find seed hashes to generate the curves to be vulnerable. It would have to be a secret attack since nobody else has found it.

Thing is… if this is true it means there is a secret attack against some elliptic curves.

Using 1990s technology they couldn’t have brute forced all that many curves, meaning some non-trivial percentage of curves must be vulnerable.

How do we know curve25519 isn’t vulnerable to this secret attack? We don’t.

The ultimate conclusion is that if NIST curves are backdoored using secret math we shouldn’t use ECC at all, at least unless NSA discloses the math. But they couldn’t do that without blowing up the Internet since so much uses the NIST curves. It would be an argument to phase out all ECC.

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#24

Post by schoen »

api wrote: post #23
Y_Y wrote: post #11

Earlier quoted context omitted.

> unless you think the NSA have an unknown backdoor that nobody was able to find Your post names sense to me, but I don't think it's too crazy to allow for the possibility that e.g. the NSA has backdoored some of the "recommended" crypto constants in current use.

There’s a strong argument against back doors of this type in ECC. To back door the NIST curves would require that the NSA knows a secret attack against ECC and used brute force search to find seed hashes to generate the curves to be vulnerable. It would have to be a secret attack since nobody else has found it. Thing is… if this is true it means there is a secret attack against some elliptic curves. Using 1990s techn…

NSA did make a mysterious announcement a few years ago that people should not use ECC and should go back to older public-key methods. Of course, due to their fundamental conflict of interest and reluctance to share their rationale, very few organizations that didn't have to follow that guidance apparently did so.

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#25

Post by api »

schoen wrote: post #24
api wrote: post #23

Earlier quoted context omitted.

There’s a strong argument against back doors of this type in ECC. To back door the NIST curves would require that the NSA knows a secret attack against ECC and used brute force search to find seed hashes to generate the curves to be vulnerable. It would have to be a secret attack since nobody else has found it. Thing is… if this is true it means there is a secret attack against some elliptic curves. Using 1990s techn…

NSA did make a mysterious announcement a few years ago that people should not use ECC and should go back to older public-key methods. Of course, due to their fundamental conflict of interest and reluctance to share their rationale, very few organizations that didn't have to follow that guidance apparently did so.

If they won’t share the rationale then we are back to speculating.

They are now pushing PQ crypto because they think, probably reasonably, that we are one or two breakthroughs from a scalable quantum computer.

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#26

Post by cheschire »

api wrote: post #25
schoen wrote: post #24

Earlier quoted context omitted.

NSA did make a mysterious announcement a few years ago that people should not use ECC and should go back to older public-key methods. Of course, due to their fundamental conflict of interest and reluctance to share their rationale, very few organizations that didn't have to follow that guidance apparently did so.

If they won’t share the rationale then we are back to speculating. They are now pushing PQ crypto because they think, probably reasonably, that we are one or two breakthroughs from a scalable quantum computer.

“Post quantum”, for anyone else confused by this seemingly obscure acronym.

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#27

Post by jiggawatts »

red_admiral wrote: post #18
Y_Y wrote: post #11

Earlier quoted context omitted.

> unless you think the NSA have an unknown backdoor that nobody was able to find Your post names sense to me, but I don't think it's too crazy to allow for the possibility that e.g. the NSA has backdoored some of the "recommended" crypto constants in current use.

Snowden said that they were doing this, I think?

The NSA definitely put back doors into cryptographic algorithms by forcing their variant into the NIST standards. E.g.: https://en.wikipedia.org/wiki/Dual_EC_DRBG

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#28

Post by tialaramex »

jiggawatts wrote: post #27
red_admiral wrote: post #18

Earlier quoted context omitted.

Snowden said that they were doing this, I think?

The NSA definitely put back doors into cryptographic algorithms by forcing their variant into the NIST standards. E.g.: https://en.wikipedia.org/wiki/Dual_EC_DRBG

Dual EC DRBG is a bad design and so you shouldn't use it. It is reasonable to believe it's backdoored, but only the same way it would be reasonable to believe David Cameron stuck his dick in a dead pig. Some people say he did, he says he didn't, there's no conclusive proof available - and it's worth noting the "source" is a man who has a grudge against Cameron.

My favourite also reasonable explanation for the mysterious Dual EC DBRG constants is that some senior person picked their favourite numbers (birthday of a niece, phone number of a friend, whatever) not realising that these should be Nothing Up My Sleeve Numbers. Later when a subordinate says "For documentation we need to explain these numbers" it was late to change them and so the agency can't do better than insist they were chosen at random.

If this was crucial technology we should do the work to re-make it with Nothing Up My Sleeve Numbers, but it's garbage, indeed that's one reason for the suspicion, this is a very complicated machine, well suited to hiding a backdoor, why do this at all?

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#29

Post by upofadown »

ramchip wrote: post #5
fguerraz wrote: post #3

It begs the question: what's wrong with RSA??? I've always heard it's because implementation is hard and ECC magically solves most of these problems, but clearly that's not the case...

"Seriously, stop using RSA" https://news.ycombinator.com/item?id=30879442

My comments on that article:

https://articles.59.ca/doku.php?id=pgpfan:rsabad

Re: Safe curves for Elliptic Curve Cryptography [pdf]

#30

Post by upofadown »

adrian_b wrote: post #4
fguerraz wrote: post #3

It begs the question: what's wrong with RSA??? I've always heard it's because implementation is hard and ECC magically solves most of these problems, but clearly that's not the case...

Even if many older RSA implementations had serious security bugs, that is not the reason why it is not preferred any more. For equivalent security with ECC (or with AES) at their typical parameters (i.e. 256 to 512 bit elliptic curves or 128-bit to 256-bit AES keys), RSA must use very long keys, even longer than any RSA keys that are used in practice (which are normally no longer than 4096 bits), which makes the RSA…

>RSA must use very long keys, ...

But probably no longer than 2048 bits:

https://articles.59.ca/doku.php?id=em:20482030

Post reply on HN