Re: [Cfrg] Task looming over the CFRG

[Johannes Merkle <[e-mail]>]

Paul Lambert wrote on 05.05.2014 22:52:
> NIST curves were created over 15 years ago.  NIST has not kept pace in this period with recommendations to mitigate attacks documented by industry. NIST has not considered the advancements in open cryptographic publications that have identified new curves and algorithms that provide improved performance and better “safety” of implementations. 


We should not mix up curves with (possibly insufficient) recommendations for side-channel resistance. These are two
different things.

I do not mean to advocate the NIST curves, but lack of "safety" is a weak argument against them. It has been shown that
time-constant and exception-free implementations of Weierstrass curves are easily possible while still obtaining good
efficiency [1]. And invalid-point attacks are very easily (and cheaply) thwarted by point validation as recommended by
NIST and ANSI standards.

IMHO, lack of rigidity and slightly inferior performance are much better arguments against NIST curves.

Johannes

[1] Joppe W. Bos, Craig Costello, Patrick Longa, Michael Naehrig: Selecting Elliptic Curves for Cryptography: An
Efficiency and Security Analysis. Cryptology ePrint Archive, Report 2014/130.