Re: [Cfrg] Requirements for elliptic curves with a view towards constrained devices

[Manuel Pégourié-Gonnard <[e-mail]>]

On 19/11/2014 17:06, RONDEPIERRE Franck wrote:
> For the sake of simplicity, the twist security is viewed as mandatory.
> Indeed, this allows to get rid of attacks without relying on the
> implementation. Without this requirement, a point on curve test is needed to
> thwart the attacks.

I'd just like to emphasise that in many situations (including TLS with
uncompressed points and implementations using "standard" short Weierstrass
formulas, ie formulas that don't involve b) the point-on-curve test *is* needed
anyway, regardless of whether the curve is twist secure or not.

I'm sure you're already aware of that, but I think we should always be extremely
clear when speaking about it, since there are already people out there making
misinterpretations of what exactly twist security buys us and more importantly
what it doesn't. I really do not want to see, in a few month/years,
implementations skipping the point-on-curve test in a context where it is needed
just because they think using a twist secure curve protects them.

(Don't get me wrong: I think twist security is nice to have, and I'd like any
curve selected by the CFRG to have this property. I just don't want it to be
seen (by people outside this group) as a silver bullet.)

Manuel.