Re: [Cfrg] Security proofs v DH backdoors

[Peter Gutmann <[e-mail]>]

Hanno Böck <[e-mail]> writes:

>Peter, I find your line of reasoning very dishonest.

Uh, it's exactly what it says on the box, if you use a repeated k you're
toast, and a fault in the RNG will give you a repeated k.

>You bring up an example that has nothing to do with ECC. The PS3 issue is a
>well known problem of both classic / finite field DSA and ECDSA. How is that
>an argument for the brittleness of ECC?

Because a faulty RNG won't kill RSA?

>As far as I see several of the papers you mention also talk about attacks
>against RSA or DSA.

Sure, but ECC just seems a lot more vulnerable to these problems than RSA
does.  And then if you want to defend against the problem the cost for a
pairwise consistency check for an RSA sig. is almost free (the public-key op
takes close to no time), while for DSA/ECDSA it has about the same cost as the
private-key op.  Looking at the ever-useful Crypto++ benchmark timings, that
makes a pairwise-consistency-checked ECDSA-256 sig. operation nearly twice as
expensive as a checked RSA-2048 one.

Peter.