Re: [Cfrg] ECC reboot (Was: When's the decision?)

[David Leon Gil <[e-mail]>]

On Fri, Oct 17, 2014 at 11:24 AM, Hallof, Andreas
<[e-mail]> wrote:
> If independent from each other three different Chipcard-Manufacturer tell me they prefer using curves with random primes then this tells me something.

It tells you that, like most semiconductor companies, they are
cheapskates. They would rather you continue to use their (existing)
inadequately protected solutions, so that they can save on design
costs.

If they can cite published work that shows that a higher level of
assurance can be achieved, given a correctly implemented masking
scheme, by using a random prime, they are free to share one.

(The previous citation from the manufacturers, AFAIK, shows an attack
on the sort of blinding scheme Joye and others have demonstrated is
inadequate -- and which does not even pass a basic smell test.)