Re: [Cfrg] ECC reboot (Was: When's the decision?)

[Andy Lutomirski <[e-mail]>]

On Thu, Oct 16, 2014 at 11:00 AM, Ilari Liusvaara
<[e-mail]> wrote:
> On Thu, Oct 16, 2014 at 06:38:55PM +0100, Alyssa Rowan wrote:
>>
>> It seems to me at this stage that the requirements of the
>> existing-hardware stakeholders of the Brainpool may be not only
>> orthogonal, but actually (potentially) in direct opposition to the
>> requirements of the software stakeholders - and further their
>> requirements may (perhaps) already be satisfied by the Brainpool curves?
>
> I think the requirements are in direct opposition.
>
> And I know no reason why existing Brainpool curves wouldn't be usable
> for "high-security" hardware.

Are the Brainpool curves really VPR?  They're certainly far better in
that regard than the NIST curves, but the BADA55 paper points out
correctly that the "verifiably" part is weak.

(The BADA55 curves themselves might actually not be so bad.  They were
clearly fudged, but the BADA55 property seems highly unlikely to be a
cryptographic weakness, and fudging them to have some other unlikely
property as well would have been rather expensive.)

--Andy