Re: [Cfrg] Mishandling twist attacks

["D. J. Bernstein" <[e-mail]>]

Watson Ladd writes:
> What exactly is wrong with telling everyone to multiply by 8, not 4,
> even if the cofactor is 4?

Who is "everyone"? What's the strategy for not merely "telling" them 8,
but also making sure that they don't follow the many existing standards
that tell them 4? Why will this strategy be more effective than, e.g.,
MQV "telling everyone" to validate public keys---exactly the step that
was skipped in HMQV, leading to the original Menezes break of HMQV?

I'm not saying that educating protocol designers is hopeless. Sometimes
it works, and sometimes it's the only hope for security. But there are
many problems that we can solve much more easily and much more robustly
by making better choices of cryptographic primitives.

---Dan