Re: [Cfrg] Hardware requirements for elliptic curves

["Lochter, Manfred" <[e-mail]>]

__________ ursprüngliche Nachricht __________

Von:		Alyssa Rowan <[e-mail]>
Datum:	Montag, 15. September 2014, 14:50:33
An:		[e-mail]
Kopie:	
Betr.:	Re: [Cfrg] Hardware requirements for elliptic curves


>
> It just doesn't look like the pendulum's swinging that way, and I can see
> why: the relatively poor performance of Brainpool-class random primes in
> software; the difficulty of securing generic elliptic curve software
> routines against timing side-channels;

Actually I don' t see your point here. Watson's mail was about special primes 
versus random primes. The use of special primes does not harden 
implementations against timing attacks. But the use of special primes makes 
additional SCA countermeasures necessary, thus increasing implementation 
cost.

> and the sheer cost-multiplication 
> potential of a proposal to mandate the option of using
> relatively-inefficient crypto near-universally across the web - including
> at CDN scale!?

What is your measure for inefficiency? Cost per Signature? Or time per 
signature? Or something different? Relatively to what?

> I think personally you'd face a massive uphill struggle 
> arguing for random curve support to ever be anything better than MAY. But
> that's something I reckon you should take over to those lists if you
> *really* want to raise it? (I'll bring marshmallows! <g>)

Can we agree on licorice?

>
> If your hardware is truly securely flexible, then you can adapt with no
> trouble; if it's not flexible enough to securely work with efficient sparse
> primes that also perform well in software, well, you probably need to
> consider at least updating it so it is (how is it with the NIST "Solinas
> primes"? Equally bad, one would have thought? Yet they're the most deployed
> by far...).

This is not a hardware question. Actually the problem is that curves over 
special primes need more SCA countermesures. This is also true for software 
running on a general purpose processor.
In fact the discussion here is not about hardware or software. It is about 
different hardware platforms (e.g. server, smart card) on which ECC is 
running under different attack models. 
>
> Also, please don't forget: FIPS 140-2 (/3?) evaluations/certifications are
> not exclusive to hardware, and neither are Common Criteria EAL*: both
> happen for certain software implementations.

Oh, really? Then you have a CC protection profile for TLS running in software 
available for review? At which EAL?

-- 
Lochter, Manfred
--------------------------------------------
Bundesamt für Sicherheit in der Informationstechnik (BSI)
Referat K21
Godesberger Allee 185 -189
53175 Bonn

Postfach 20 03 63
53133 Bonn

Telefon: [phone] 5643
Telefax: [phone] 5643
E-Mail: [e-mail]
Internet:
www.bsi.bund.de
www.bsi-fuer-buerger.de