Re: [Cfrg] Task looming over the CFRG

[Paul Lambert <[e-mail]>]

Johannes,

On 5/6/14, 5:05 AM, "Johannes Merkle" <[e-mail]> wrote:

>Paul Lambert wrote on 05.05.2014 22:52:
>> NIST curves were created over 15 years ago.  NIST has not kept pace in
>>this period with recommendations to mitigate attacks documented by
>>industry. NIST has not considered the advancements in open cryptographic
>>publications that have identified new curves and algorithms that provide
>>improved performance and better ³safety² of implementations.
>
>
>We should not mix up curves with (possibly insufficient) recommendations
>for side-channel resistance. These are two
>different things.
>
>I do not mean to advocate the NIST curves, but lack of "safety" is a weak
>argument against them.

Yes.  I agree, and normally avoid the term ³safe² for these comparisons.
However, after close reading of the last decade of NIST publications there
is no recomendations on such potential vulnerabilities.
Plus 
>It has been shown that
>time-constant and exception-free implementations of Weierstrass curves
>are easily possible while still obtaining good
>efficiency [1]. 
None of which are documented by NIST.


>And invalid-point attacks are very easily (and cheaply) thwarted by point
>validation as recommended by
>NIST and ANSI standards.
Yes.  ³Safe² has become a smoke cloud of several possible issues some more
important than others.  The point validation is well covered by NIST.
The comparable topic for Curve25519 is the special selection of the secret
key which is never mentioned as a issue/criteria.


>
>IMHO, lack of rigidity and slightly inferior performance are much better
>arguments against NIST curves.


Here¹s another attempt at ranking (from --- to +++ range)


               NIST   Twisted Edwards
Side Channel    +         +++
Performance     +         +++
Rigidity        -         +++

I¹m not sure it¹s possible to get this mailing list to agree on the
subjective value of some of the criteria.   My earlier rant was trying to
stress the time period that has passed without evaluation or improvements
on the NIST recommendations.  Progress has been made that should be
captured in recomendations for new curves.

Paul


>
>Johannes
>
>[1] Joppe W. Bos, Craig Costello, Patrick Longa, Michael Naehrig:
>Selecting Elliptic Curves for Cryptography: An
>Efficiency and Security Analysis. Cryptology ePrint Archive, Report
>2014/130.
>
>
>