[Cfrg] What I do all day, or the myth of curve specific cryptanalysis

[Watson Ladd <[e-mail]>]

Dear all,

Some people think that when Claus Diem sat down and wrote the best
known attack on binary curves, he did so by taking a curve, and
thinking about how to solve the discrete logarithm problem on that
curve, then generalizing. Would they also think that we cryptanalyze
AES by first thinking about the zero key, then the key equal to one,
and so on?

Of course, that's not what Claus Diem, or any algebraic geometer
actually does. They write down examples to understand general
principles, but when it comes to elliptic curves we have a vast body
of knowledge already. Instead they ask "what would really help me with
this problem?", look and find that structure.

Could someone explain any feature of P-256 that is potentially
distinctive, vs. some random curve? Of course, we know many
shortcomings of short Weierstrass curves: much software does the
calculations incorrectly in edge cases. I've found these errors in
several extensively used libraries, including a few still being fixed.

The solution to this nonissue being proposed is to further complicate
implementations to have to check generated parameters, or complicate
protocol designers job by dealing with the consequences of one side
specifying bad parameters. That's on top of performance disadvantages
from having to genericise arithmetic, as well as tougher constant time
assurances. Are you willing to bet money that I can't find a mistake
when you make it more complicated?

Sincerely,
Watson Ladd