Re: [Cfrg] malicious DH base points [was Re: should the CFRG really strive for consensus?]

[Adam Back <[e-mail]>]

On 3 January 2015 at 18:28, Paterson, Kenny <[e-mail]> wrote:
>>On Thu, 2015-01-01 at 13:39 +0100, Adam Back wrote:
>>> Seems like on
>>> topic and to the point, not spam.
>
> And as Adam Langley and others have pointed out, no-one seriously
> believes that the choice of base point has any security impact (a more
> refined statement about this to which I can subscribe can be found at the
> bottom of the safecurves page here:

Nevertheless I think it should be part of the NUMS generation.

Apart from the academic paper which hypothesises a combined weakness
between the generator and the KDF for key-exchange (which again, is
NOT off-topic), there are situations where you need pairs of
generators which no one knows the discrete log of (for example like
EC_DBRG, a backdooring topic known to all; or u-prove/Brands
representation problem a DL/ECDL schnorr-extension attribute
certificate, which has multiple bases, probably there are other
examples)

If those are mixed with the main base point which is chosen using
unexplained randomness, then it maybe that even if we use G (the main
and non-NUMS base) plus H which given its intended to demonstrate lack
of knowledge wrt to H, would be generated with NUMS, that still fails
because maybe the person who generated G chose it such that it is the
discrete log of H (or vice-versa -- its the same thing).

I dont see what motive we can have for not NUMS the G parameter to for
the avoidance of doubt - its not as if there's a big cost to that.

Adam