Subject: Re: [Cfrg] Elliptic Curves - curve form and coordinate systems

From: Peter Gutmann <[email-masked]>
Date: Mon, 16 Mar 2015 01:52:01 +0000

"D. J. Bernstein" <[email-masked]> writes:

>How many years did it take for this bug to be found in a very widely used
>cryptographic library? Who's reviewing all the other NIST P-256
>implementations to see whether they even _try_ to validate points, never mind
>whether they get it right?

Well, it *is* OpenSSL, what were you expecting?  OTOH other libraries are
often no better, it was only as a result of extensive bad publicity that
vendors like Microsoft and Mozilla decided that allowing things like RSA keys
with exponent 1 were a bad thing, not to mention DH values you could break on
a pocket calculator and other silliness.  So "lack of input validation"
doesn't just apply to ECC parameters, it's everywhere.

>[25519 advantages]

It is certainly a much safer design than existing stuff.  Now if only it got
the endianness of its on-the-wire form right...

Peter.