[Cfrg] Twist security question
Dan Brown <dbrown@certicom.com> Mon, 21 July 2014 17:07 UTC
Return-Path: <dbrown@certicom.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A093E1A00C3 for <cfrg@ietfa.amsl.com>; Mon, 21 Jul 2014 10:07:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XrYlYDMRCngF for <cfrg@ietfa.amsl.com>; Mon, 21 Jul 2014 10:07:15 -0700 (PDT)
Received: from smtp-p02.blackberry.com (smtp-p02.blackberry.com [208.65.78.89]) by ietfa.amsl.com (Postfix) with ESMTP id 110A91A00C2 for <cfrg@irtf.org>; Mon, 21 Jul 2014 10:07:10 -0700 (PDT)
Received: from xct101cnc.rim.net ([10.65.161.201]) by mhs214cnc.rim.net with ESMTP/TLS/AES128-SHA; 21 Jul 2014 13:07:06 -0400
Received: from XMB116CNC.rim.net ([fe80::45d:f4fe:6277:5d1b]) by XCT101CNC.rim.net ([fe80::9c22:d9c:c906:c488%16]) with mapi id 14.03.0174.001; Mon, 21 Jul 2014 13:07:05 -0400
From: Dan Brown <dbrown@certicom.com>
To: "cfrg@irtf.org" <cfrg@irtf.org>
Thread-Topic: Twist security question
Thread-Index: Ac+lBjJ/jspEZYkdTLK4AZ6myj9axg==
Date: Mon, 21 Jul 2014 17:07:05 +0000
Message-ID: <20140721170703.6656149.88919.16917@certicom.com>
Accept-Language: en-CA, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="SHA1"; boundary="===============2019853508=="
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/IuUb06jGt_dNCGQj8oMo1iOF-xY
Subject: [Cfrg] Twist security question
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Jul 2014 17:07:22 -0000
Since Curve25519 DH protocol lets info about private key out via the twist (then kdf, mac and cipher), it seems to require an extra computational assumption, right? Probably this has been considered before. Maybe there's a reduction to a standard problem, or a generic group model proof, at least, which ought to be easy. Best regards, -- Dan PS N. Smart's comments about twist security got me thinking about this.
- [Cfrg] Twist security question Dan Brown
- Re: [Cfrg] Twist security question Michael Hamburg
- Re: [Cfrg] Twist security question Robert Ransom