Re: [Cfrg] Progress on curve recommendations for TLS WG

[Johannes Merkle <[e-mail]>]

Alyssa Rowan wrote on 15.08.2014 14:35:
> Respectfully, deferring choices made in the curve generation process back to ANSI X9.62 (even though it may have
> made sense at the time) doesn't alleviate any potential concerns about lack of rigidity in those choices; it merely
> means they weren't Brainpool's own choices, and no-one thought to question them at the time quite as deeply as they
> do today.
> 
> If X9.62's choices had full, rigid, transparent explanations, perhaps this discussion would have not arisen, and in
> that vein perhaps neither would Brainpool? But they did not (and although Certicom/NSA indeed seem to have
> performed a brute-force seed search for the SECG/NIST curves, we may never be certain what all the parameters of
> that search were): so here we are.
> 


The issue many people on this list (including me) have with the NIST curves is not the curve generation method but the
unexplained seeds. If you mean to imply that the method itself is suspicious, independent of the seeds, then this is a
position I have not yet seen expressed, and I doubt that many people will find it plausible.

Actually, this is the core of the problem with the discussion on rigidity: It is more about sense than about facts. Do
you feel comfortable with this generation procedure or with those constants, or with others? Something that you might
deem very straightforward and rigid may look arbitrary and even suspicious to others. Rigidity can not be measured
objectively. This makes it easy to argue against one or the other approach.

It is important that, whatever curves CFRG selects, anyone can feel comfortable with their rigidity and that there
will be no doubts about their security and the lack of back-doors. The BADA55 paper and the post I was responding to,
though intended to be provocative and entertaining, introduce FUD in that respect and are contra-productive. I am
quite sure that one could also construct a "one in a million curve" using a seed-less approach very similar to
curve25519, but this would only introduce more unjustified discredit and FUD.

We should focus on establishing trust not FUD.

-- 
Johannes