Re: [Cfrg] Primes vs. hardware side channels

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 17/10/2014 01:55, D. J. Bernstein wrote:

> This seems safe if the bits are further obscured by a considerable
> level of physical noise. However, for plausibly smaller noise
> levels this is breakable, as illustrated by the recent paper by
> Schindler and Wiemers.

In line with my previous comments, I'm just going to +1 all of this
message, but particularly this bit right here.

I also have a big question about whether wanting to minimise costs by
reusing certifications for existing RSA hardware - and reusing that
existing hardware for ECC - is necessarily sound in light of new
research, new information, serious concerns raised about the efficacy
and integrity of existing certification processes, wanting open
alternatives, not working well with the NIST curves either, and so on.

And there again is the point I made earlier: if they want Brainpool,
they've already _got_ Brainpool. Nobody else seems to want it. That's
why we're being asked for _new_ curves. And why they should design
_new_ hardware to support them. (And protect against 'new' threats.)

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJUQLRHAAoJEOyEjtkWi2t6hS4P/1aSXUZOFwqJcZgl1KUGwbGa
NNivBhVSKWWs1dVRa+AbwUbEtN3rbkIG3NGhKikItlrLwSGLD1PSaEbjDYHZFGAC
u57iwJo5owgxNJBmrOhCZb43Tgf4QJeGr5UddbLqQLZ1/RX6dw9Aw2qJUF3BrkZ5
sqEkdu3hrTcaqh5ieSXulAZPau7WnK1BZ44Y01cv4tk/nE+zpMUQsIziyiFtSLzd
pbaBjBpC3AT3Y58uFeGqyRSadYkXZdkauBuVTwPRGTijPhSD5Jg6+UJ3i+WaYxKK
FymR2dBp2oLQDe2P9wd1MK16qY+B8g7nIWAXcmfv/h61bQjKSwU4tVrnV4g4ZIj4
S16i4QGajAmzTDZbwB3sfPvhiD/zcBDALhsD6yLiVQWAtvcGE+a6OYx0rqqVwDcr
EAEofn7gqWnvhHABopOhxdJe6voVyEzq0LrXhKjDbGYOiTb+TiSxdfXikxgrU0IU
2eqa/n83WRuQuK1SG2v0w77kgNowTpPC5GsOLLJRm1C4IKzTcW11JyQwPhVEPX4d
QqSVijf9wEJOkqK4LZLmZXTcTPpv2IqMRy98q5tXm5D69qcTGBPwKjHIWDNeGMRe
rFsvuDe7t+97GcF0K8EGH31EdUWibzh7UiXl7SV8T0xd4Zf39T7ZRRuRP+vHSW8h
9dS/nCuE70ASuGsXCGwa
=OzoT
-----END PGP SIGNATURE-----