Subject: [Cfrg] What I do all day, or the myth of curve specific cryptanalysis

From: Watson Ladd <[email-masked]>
Date: Sun, 3 May 2015 10:14:27 -0700

Dear all,

Some people think that when Claus Diem sat down and wrote the best
known attack on binary curves, he did so by taking a curve, and
thinking about how to solve the discrete logarithm problem on that
curve, then generalizing. Would they also think that we cryptanalyze
AES by first thinking about the zero key, then the key equal to one,
and so on?

Of course, that's not what Claus Diem, or any algebraic geometer
actually does. They write down examples to understand general
principles, but when it comes to elliptic curves we have a vast body
of knowledge already. Instead they ask "what would really help me with
this problem?", look and find that structure.

Could someone explain any feature of P-256 that is potentially
distinctive, vs. some random curve? Of course, we know many
shortcomings of short Weierstrass curves: much software does the
calculations incorrectly in edge cases. I've found these errors in
several extensively used libraries, including a few still being fixed.

The solution to this nonissue being proposed is to further complicate
implementations to have to check generated parameters, or complicate
protocol designers job by dealing with the consequences of one side
specifying bad parameters. That's on top of performance disadvantages
from having to genericise arithmetic, as well as tougher constant time
assurances. Are you willing to bet money that I can't find a mistake
when you make it more complicated?

Sincerely,
Watson Ladd

---

From: "David Leon Gil" <[email-masked]>
Date: Mon, 04 May 2015 11:40:01 -0700 (PDT)

Your criticisms apply just as well to the partisans of rigidity as to the courtesans of aleatory.

(You cycle-counters anyways have won.)

—
Sent using alpine: an Alternatively Licensed Program for Internet News and Email

On Sun, May 3, 2015 at 10:14 AM, Watson Ladd <[email-masked]>
wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg