Re: [Cfrg] Structure in the S-box of the Russian algorithms (RFC 6986, RFC 7801)

[Tony Arcieri <[e-mail]>]

On Sun, Feb 10, 2019 at 10:44 PM Stanislav V. Smyshlyaev <[e-mail]>
wrote:

> But those curves were generated in 2012 - they reflected best practices
> and state-of-the-art of that time. And Streebog was used for the obvious
> reason - it was a new hash function that was standardized in Russia (as a
> part of GOST R 34.11-2012 standard) and available for me and my colleagues.
>

I'm not accusing you of acting in bad faith (and to the extent I may have
done that in my tweet regarding Streebog in general I apologize, it was
moderately out of proportion).

That said, one of the main goals of the CFRG in selecting new elliptic
curves was to have a set of "rigid" selection guidelines (a.k.a. "nothing
up my sleeve"). A series of circumstances like this is the exact reason why
it's nice for the curve parameter selection process to be beyond reproach,
and if nothing else serves as an illustrative example of what could go
wrong in a standardization process which doesn't follow this approach.

-- 
Tony Arcieri