Re: [Cfrg] Progress on curve recommendations for TLS WG

On Aug 15, 2014 7:23 AM, "Johannes Merkle" <johannes.merkle@secunet.com>
wrote:
>
> Alyssa Rowan wrote on 15.08.2014 14:35:
> > Respectfully, deferring choices made in the curve generation process
back to ANSI X9.62 (even though it may have
> > made sense at the time) doesn't alleviate any potential concerns about
lack of rigidity in those choices; it merely
> > means they weren't Brainpool's own choices, and no-one thought to
question them at the time quite as deeply as they
> > do today.
> >
> > If X9.62's choices had full, rigid, transparent explanations, perhaps
this discussion would have not arisen, and in
> > that vein perhaps neither would Brainpool? But they did not (and
although Certicom/NSA indeed seem to have
> > performed a brute-force seed search for the SECG/NIST curves, we may
never be certain what all the parameters of
> > that search were): so here we are.
> >
>
>
> The issue many people on this list (including me) have with the NIST
curves is not the curve generation method but the
> unexplained seeds. If you mean to imply that the method itself is
suspicious, independent of the seeds, then this is a
> position I have not yet seen expressed, and I doubt that many people will
find it plausible.
>
> Actually, this is the core of the problem with the discussion on
rigidity: It is more about sense than about facts. Do
> you feel comfortable with this generation procedure or with those
constants, or with others? Something that you might
> deem very straightforward and rigid may look arbitrary and even
suspicious to others. Rigidity can not be measured
> objectively. This makes it easy to argue against one or the other
approach.
>
> It is important that, whatever curves CFRG selects, anyone can feel
comfortable with their rigidity and that there
> will be no doubts about their security and the lack of back-doors. The
BADA55 paper and the post I was responding to,
> though intended to be provocative and entertaining, introduce FUD in that
respect and are contra-productive. I am
> quite sure that one could also construct a "one in a million curve" using
a seed-less approach very similar to
> curve25519, but this would only introduce more unjustified discredit and
FUD.
>

Hic rhodes, hic saltus.

> We should focus on establishing trust not FUD.
>
> --
> Johannes
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg