Re: [Cfrg] Progress on curve recommendations for TLS WG

[Watson Ladd <[e-mail]>]

On Aug 15, 2014 9:41 AM, "Johannes Merkle" <[e-mail]>
wrote:
>
> Watson Ladd wrote on 15.08.2014 16:29:
> >>
> >> It is important that, whatever curves CFRG selects, anyone can feel
> > comfortable with their rigidity and that there
> >> will be no doubts about their security and the lack of back-doors. The
> > BADA55 paper and the post I was responding to,
> >> though intended to be provocative and entertaining, introduce FUD in
that
> > respect and are contra-productive. I am
> >> quite sure that one could also construct a "one in a million curve"
using
> > a seed-less approach very similar to
> >> curve25519, but this would only introduce more unjustified discredit
and
> > FUD.
> >>
> >
> > Hic rhodes, hic saltus.
>
> Consider Dan Brown's construction as an example. You may consider his
construction artificial as he considers attacks
> that are already known. However, this is exactly my point: You can find
such examples if you stretch the boundaries of
> the scope in order to increase the degrees of freedom. In order to create
sufficient flexibility, the BADA55 paper has
> generalized the method(s) of ANSI and Brainpool in many aspects, but
these generalizations are much less natural and
> straightforward as the original approaches. In the same vein, one could
slightly modify the rules for selecting the
> curve parameters used in a seed-less approach, and this generalization
would certainly provoke your criticism as not
> being straightforward. So we would arrive at an example that does not
really show anything but could be easily mistaken
> by someone with less insight (e.g. the press) to wrongly conclude that
the seed-less approach is generally suspicious.
> This FUD effect would be bad.

Put the string BADA55 in the hex output of the parameters to convince us.
It's that simple. The reason Dan Brown's example isn't convincing is that
having only  prime factors of not that small size is common.

>
> For this reason, I tried to appeal to stop this unfortunate discussion in
which contrived examples are used to discredit
> much more straightforward approaches, but unfortunately, my post seem to
have stimulated it.
>
>
> --
> Johannes