Re: [Cfrg] [CFRG] Safecurves v Brainpool / Rigid v Pseudorandom

[Johannes Merkle <[e-mail]>]

David McGrew schrieb am 16.01.2014 01:04:
> 
> I think the advocates of "rigid" curves mean to highlight the fact that the rigid process can generate only a small
> number of curves. In contrast, when we are presented by a verifiably pseudorandom curve that was generated with an input
> seed of unknown provenance, it might be the case that many seeds were tested and rejected until one was found that
> generated a curve on which the DL problem could be solved more easily.   (Your model of "each curve has some probability
> of being vulnerable to an unknown attack" I think captures the concern, though one could generalize to a situation in
> which the expected running time of the DLP varied with the parameters.)
> 
My understanding of Dan's reasoning is different. I think, the "unknown" in "probability of being vulnerable to an
unknown attack" relates to the entity generating the curve, i.e. NUTS captures the objective of generating curves in a
way that minimizes the "probability" that the curve may be or become vulnerably to attacks unknown by the party
generating the curve.

Of course, "probability" refers more to a "feeling in the guts" than to a (Bayesian) probability.


> Now, it would be possible to make a "rigid" process out of a pseudorandom process by using a seed value that nobody can
> control (say, the sha512 hash of SP500 prices on a given future date). Perhaps this is what you mean by PRF(NUMS) -> NUNS?
> 

In retrospective this approach would be less convincing because some might still speculate that seed definition had been
specified at a later point of time, in spite of all evidence records.

And still, DJB could argue that the freedom in choices made for the derivation of the parameters, e.g. SHA-512, leaves
some questions unanswered, and he would probably label these curves (on the safecurve page) as being only "somewhat rigid".

regards,
Johannes