[Cfrg] Influences [was RE: [TLS] draft-sheffer-tls-bcp: DH recommendations]

[Peter Gutmann <[e-mail]>]

Dan Brown <[e-mail]> writes:

>1. You seem to be saying there that P256 has security problems

Not at all.  I was pointing out (possibly not too clearly :-) that once you
get past the purely technical issues you're now introducing political ones.
Given the paranoia about NSA-tainted crypto (I've even seen people questioning
AES, which was probably as non-tained as you can get), expecting people to
switch from DH to what people will perceive as "NSA-influenced values that the
NSA has been awfully keen to get everyone to use" will run into problems at
the political level.
http://crypto.stackexchange.com/questions/10263/should-we-trust-the-nist-recommended-ecc-parameters
is one example of where this could end up.

(According to that thread, the values weren't just NSA-influenced, they came
directly from the NSA:

  The Bernstein/Lange presentation says the NIST elliptic curves were created
  by "Jerry Solinas at NSA".

Given the ongoing Snowden revelations, what do you think the chances are of
(say) the French, or German, or Belgian, or ..., government adopting
parameters from "Jerry Solinas at NSA"?).

Peter.