Re: [Cfrg] Progress on curve recommendations for TLS WG

[Johannes Merkle <[e-mail]>]

Watson Ladd wrote on 15.08.2014 16:29:
>>
>> It is important that, whatever curves CFRG selects, anyone can feel
> comfortable with their rigidity and that there
>> will be no doubts about their security and the lack of back-doors. The
> BADA55 paper and the post I was responding to,
>> though intended to be provocative and entertaining, introduce FUD in that
> respect and are contra-productive. I am
>> quite sure that one could also construct a "one in a million curve" using
> a seed-less approach very similar to
>> curve25519, but this would only introduce more unjustified discredit and
> FUD.
>>
> 
> Hic rhodes, hic saltus.

Consider Dan Brown's construction as an example. You may consider his construction artificial as he considers attacks
that are already known. However, this is exactly my point: You can find such examples if you stretch the boundaries of
the scope in order to increase the degrees of freedom. In order to create sufficient flexibility, the BADA55 paper has
generalized the method(s) of ANSI and Brainpool in many aspects, but these generalizations are much less natural and
straightforward as the original approaches. In the same vein, one could slightly modify the rules for selecting the
curve parameters used in a seed-less approach, and this generalization would certainly provoke your criticism as not
being straightforward. So we would arrive at an example that does not really show anything but could be easily mistaken
by someone with less insight (e.g. the press) to wrongly conclude that the seed-less approach is generally suspicious.
This FUD effect would be bad.

For this reason, I tried to appeal to stop this unfortunate discussion in which contrived examples are used to discredit
much more straightforward approaches, but unfortunately, my post seem to have stimulated it.


-- 
Johannes