Re: [Cfrg] Requirements for elliptic curves with a view towards constrained devices

__________ ursprüngliche Nachricht __________

Von:		"Manuel Pégourié-Gonnard" <mpg@elzevir.fr>
Datum:	Donnerstag, 20. November 2014, 09:56:42
An:		RONDEPIERRE Franck <F.RONDEPIERRE@oberthur.com>, "cfrg@irtf.org" 
<cfrg@irtf.org>
Kopie:	
Betr.:	Re: [Cfrg] Requirements for elliptic curves with a view towards 
constrained devices

> On 19/11/2014 17:06, RONDEPIERRE Franck wrote:
> > For the sake of simplicity, the twist security is viewed as mandatory.
> > Indeed, this allows to get rid of attacks without relying on the
> > implementation. Without this requirement, a point on curve test is needed
> > to thwart the attacks.
>
> I'd just like to emphasise that in many situations (including TLS with
> uncompressed points and implementations using "standard" short Weierstrass
> formulas, ie formulas that don't involve b) the point-on-curve test *is*
> needed anyway, regardless of whether the curve is twist secure or not.
>
> I'm sure you're already aware of that, but I think we should always be
> extremely clear when speaking about it, since there are already people out
> there making misinterpretations of what exactly twist security buys us and
> more importantly what it doesn't. I really do not want to see, in a few
> month/years, implementations skipping the point-on-curve test in a context
> where it is needed just because they think using a twist secure curve
> protects them.
>
> (Don't get me wrong: I think twist security is nice to have, and I'd like
> any curve selected by the CFRG to have this property. I just don't want it
> to be seen (by people outside this group) as a silver bullet.)
>
I would like to add another aspect. Having  a twist secure curve E means that 
E and its twist E' provide the same degree of security against purely 
mathematical attacks. However, if one takes SCA into accout the situation may 
change. One of the two curves will contain a point with x-coordinate zero. 
For this point projective randomisation will not work properly. 

Manfred 

> Manuel.
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
Lochter, Manfred
--------------------------------------------
Bundesamt für Sicherheit in der Informationstechnik (BSI)
Referat K21
Godesberger Allee 185 -189
53175 Bonn

Postfach 20 03 63
53133 Bonn

Telefon: +49 (0)228 99 9582 5643
Telefax: +49 (0)228 99 10 9582 5643
E-Mail: manfred.lochter@bsi.bund.de
Internet:
www.bsi.bund.de
www.bsi-fuer-buerger.de