Re: [Cfrg] Structure in the S-box of the Russian algorithms (RFC 6986, RFC 7801)

[Tony Arcieri <[e-mail]>]

On Sun, Feb 10, 2019 at 1:50 PM Leo Perrin <[e-mail]> wrote:

> This situation is unlike anything else in the literature. [...] Still, at
> the moment, I don't know of any attack leveraging my new decomposition as
> the partition in the input is the partition in multiplicative cosets (and
> not additive ones). Nevertheless, I can't think of a good reason for the
> designers of these algorithms to use this structure and, worse, to keep
> this fact secret; especially since the presence of such properties demands
> a specific analysis to ensure that the algorithms are safe.
>

Streebog was used as the hash function for the elliptic curve generation
procedure for 512-bit Edwards curves standardized in GOST R 34.10-2012. I'm
curious, even hypothetically, if this attack could be combined with an
attacker-controlled hash input (W) to maliciously influence curve parameter
selection.

Thread:
https://mailarchive.ietf.org/arch/msg/cfrg/1L7W2lPu4MtcHOfjoTFn_mmGPG4

A selected email below with an interesting passage highlighted...

---------- Forwarded message ---------
From: Stanislav V. Smyshlyaev <[e-mail]>
Date: Wed, Jan 28, 2015 at 6:14 AM
Subject: Re: [Cfrg] 512-bit twisted Edwards curve and curve generation
methods in Russian standardization
To: Alyssa Rowan <[e-mail]>, [e-mail] <[e-mail]>


Dear Alyssa,

As we believe (and as it has been mentioned earlier during discussion at
CFRG), the initital seed value doesn't have to be chosen explicitly in case
of trust in basic hash function properties – to gain some "backdoor-type"
properties of the curve with d = hash(W), one has either to *combine such
algebraic properties of a curve with properties of a hash function* (for a
trivial example, to have an ability to obtain a hash preimage) or to choose
a very probable "backdoor-type" property of a curve (such that it is
possible to obtain by random choice of a curve).

-- 
Tony Arcieri