Re: [Cfrg] Meeting notes

["Derek Atkins" <[e-mail]>]

Yoav,

On Fri, March 27, 2015 8:49 am, Yoav Nir wrote:
[snip]
>
> === Fourth item: the Algebraic Eraser (Paul E Gunnels)
> Protocol for IoT things.
>
> Renee: what about sigs
> Atkins: a little different. fleshing
> Yoav: if it's good for IoT, why not for everything else?
> Derek Atkins: that's just our focus.
> Nico: Because this needs a trusted 3rd party that can break everything
> KP: need some more cryptanalysis to know that key search is the best
> attack.
> PEG: there are other attacks. One to recover the conjugator. Another to
> recover the matrix part or the private key. Those have been refuted -
> reduced to exhaustive search.
> AGL: have you tried an optimized implementation? Would it be 70x faster on
> a quality CPU?
> Derek: I have seen 50x. AE could benefit from larger tables on commodity
> CPU.
> Stephen Farrell: trusted third party - what does it need to do
> Derek: the trusted 3rd party is needed for the curve parameters.
> AGL: on a large scale you would need... (OK, I didn't understand the
> trusted 3rd party issue...)

AE has a set of public parameters that you use to generate keypairs that
can communicate (the equivalent of an ECC Curve or DH Prime).  The issue
is that you need random data to generate those public parameters, and that
random data needs to be kept secret.  Once the parameters are generated
you don't need access to the random data ever again, but the issue, as I
understand it, is "how do you know that that random data wasn't
compromised during the parameter generation process?"

Hopefully this better explains the issue?

Thanks,

-derek
-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant