Re: [Cfrg] [CFRG] Safecurves v Brainpool / Rigid v Pseudorandom

[David McGrew <[e-mail]>]

Hi Johannes,

On 01/16/2014 05:59 AM, Johannes Merkle wrote:
> David McGrew schrieb am 16.01.2014 01:04:
>> I think the advocates of "rigid" curves mean to highlight the fact that the rigid process can generate only a small
>> number of curves. In contrast, when we are presented by a verifiably pseudorandom curve that was generated with an input
>> seed of unknown provenance, it might be the case that many seeds were tested and rejected until one was found that
>> generated a curve on which the DL problem could be solved more easily.   (Your model of "each curve has some probability
>> of being vulnerable to an unknown attack" I think captures the concern, though one could generalize to a situation in
>> which the expected running time of the DLP varied with the parameters.)
>>
> My understanding of Dan's reasoning is different. I think, the "unknown" in "probability of being vulnerable to an
> unknown attack" relates to the entity generating the curve, i.e. NUTS captures the objective of generating curves in a
> way that minimizes the "probability" that the curve may be or become vulnerably to attacks unknown by the party
> generating the curve.
>
> Of course, "probability" refers more to a "feeling in the guts" than to a (Bayesian) probability.
>
>
>> Now, it would be possible to make a "rigid" process out of a pseudorandom process by using a seed value that nobody can
>> control (say, the sha512 hash of SP500 prices on a given future date). Perhaps this is what you mean by PRF(NUMS) -> NUNS?
>>
> In retrospective this approach would be less convincing because some might still speculate that seed definition had been
> specified at a later point of time, in spite of all evidence records.

Yes, I agree.

David

>
> And still, DJB could argue that the freedom in choices made for the derivation of the parameters, e.g. SHA-512, leaves
> some questions unanswered, and he would probably label these curves (on the safecurve page) as being only "somewhat rigid".
>
> regards,
> Johannes
>
> .
>