Re: [Cfrg] Meeting notes

On Mar 27, 2015 1:56 PM, "Derek Atkins" <derek@ihtfp.com> wrote:
>
> Hi,
>
> On Fri, March 27, 2015 10:44 am, Yoav Nir wrote:
> >
> >> On Mar 27, 2015, at 8:29 AM, Derek Atkins <derek@ihtfp.com> wrote:
>
> >> AE has a set of public parameters that you use to generate keypairs
that
> >> can communicate (the equivalent of an ECC Curve or DH Prime).  The
issue
> >> is that you need random data to generate those public parameters, and
> >> that
> >> random data needs to be kept secret.  Once the parameters are generated
> >> you don't need access to the random data ever again, but the issue, as
I
> >> understand it, is "how do you know that that random data wasn't
> >> compromised during the parameter generation process?"
> >>
> >> Hopefully this better explains the issue?
> >
> > Not quite. For ECC and DH these parameters were generated once, and then
> > those public parameters were published in an RFC or NIST document. So 10
> > years after their generation, we still use those public parameters and
we
> > don’t ever need access to any random data that was used to generate
them.
> > They’re hard-coded in every implementation.
> >
> > Is that the same for AE?
>
> Yes.
>
> >          Because if it is, you could just generate those
> > parameters, stick them in the draft and be done with it (up to some NUMS
> > claims that can be solved with a key generation ceremony that need
happen
> > only once.
>
> Exactly.

NIST published the seeds used. But in an email above it's claimed the
random data used must be secret. This us a large difference from ECC.
>
> > Thanks.
> >
> > Yoav
>
> -derek
>
> --
>        Derek Atkins                 617-623-3745
>        derek@ihtfp.com             www.ihtfp.com
>        Computer and Internet Security Consultant
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg