Re: [Cfrg] Mishandling twist attacks

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 28/11/2014 01:40, D. J. Bernstein wrote:

> Given the fact that Microsoft's curve-generation procedure is
> clearly subject to change, let me suggest a possible way forward.
> Microsoft adds further security criteria to its generation
> procedure, such as requiring the twist cofactor to divide the curve
> cofactor. For 2^255-19 it ends up with Curve25519---what a
> surprise! Microsoft then switches to proposing the latest edition
> of its "most trustworthy curve", namely Curve25519. This wouldn't
> resolve everything---I'd have to ask Microsoft to stop saying "new"
> for curves that really aren't new, and presumably there would still
> be discussion of larger primes---but surely it would help.

+1. This seems like an excellent way forward!

If the rpgecc authors (Microsoft Research/agl, et al) adopt this
approach, then I think we could perhaps (finally) reach consensus
about the choice of the ≈WF128 curve!

We'd then be able to move on to discussion about the "jumbo" curve
(which then would also have this useful security criteria).

Thoughts?

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJUeBgSAAoJEOyEjtkWi2t6S3wQAI+6BpyPaWNb7yh537G7TgTe
s95c6aiPZZj4hlynbccCOgQDsuS2fyUO8VbZoA+6D9CWfsVzVLmPgGr8fE8vbZuj
+p0K+XTepYFzdX2WZqNQcq4KtOH4SeIPRBcFC/zx2VIAUcLX2b36FxJmxnvpPSar
Yl9Dno8S0T9+X+K2iOF+ZC0bKOwowuFf1idEY+9DnH+BIIvyiSNkn2meGSxm56Qf
WqMxnB/JhHfcZo4QT3bMZH8OHsBlVPPu+ohSO0+rt0li4esKM0kX3iQWze28DgrZ
GEBMVrXPk90RzahO1myI37mse1voFCTgHsk8+jYJmPSFVp+2KlkLd0Lw57cf3bQ0
B3/CoFNPhasoUsQSe65CPnbA5OVrWnNfp4OI5zBDxeTEiXMhd8u/2czV6Cro1tKF
owZj2IIWwQ4wC4rm4c+CHXTr4xlY5v+H9pw6Q5OWxvQ2bRkLVbp7M2JY/DOnJhmo
dSXwfFlx8kpF8KPjz3jlH+Y5KrKsjtY3Ul3k0G1T5ksje7vF4wJyh13rbO13gBKq
5OQoM7R2Qdk3z4GycsE9wT1/3VsnF9Vbrmr7iltq2mdxEcXPvWqniGKOmZKAYUj2
TCKpsVJ1lvmsbgZYUNu3784OKG6GPiQKqagwjdXI7gDI9P5GEITnpsiL5VHa808I
sngg6C2/5njrIOOWav9Z
=Dnwm
-----END PGP SIGNATURE-----