Re: [Cfrg] 512-bit twisted Edwards curve and curve generation methods in Russian standardization

["Stanislav V. Smyshlyaev" <[e-mail]>]

I totally understand that a property that occurs with 2^{-18} (as Bernstein
did with BADA55 curves) can be forced to exist in the selected curve. The
example that I posted earlier is the specific curve that is standardized in
Russia, by a group of experts where the condition mentioned by Paul ("a
group where even if a single person is trusted") is satisfied ("trusted"
for us, not for the international community and CFRG, I suppose).

When we generated our curves and fixed base points, the main problem that
we addressed was to ensure that for all protocols that make use of elliptic
curves and require "provably unknown" logarithms of some points (for
example, password protected key establishment, PAKE, EKE, PACE, etc.) can
obtain such a property: x-coordinates of base points and constant points
for prototocols are chosen by hashing some random seeds – we don't want
only a blind belief of randomness of such points (the most painful example
here is Dual EC DRBG, of course). We look at curve generation problem in a
similar way: we cannot be secure against the unknown bad properties of
curves that occur with probability of 2^{-18} – even if the procedure is
totally "rigid". But at least we can be sure that if some bad property of
our curves is found, we would know that this couldn't be a "backdoor" that
can be exploited only by developers of the curve, who know some logarithms,
preimages etc. (again, as with DUAL EC DRBG).

If to talk about new curves for CFRG document, the usage of deterministic
("rigid") procedure is quite reasonable, we agree here. We've posted our
curve because we think that it can be interesting for CFRG to look at one
of the curves that have been standardized for all Russian cryptographic
community. We'll post some specific comments to the current draft later
today.

​Best regards,
Stanislav V. Smyshlyaev, Ph.D.,
Head of Information Security Department,
CryptoPro LLC