Re: [Cfrg] Progress on curve recommendations for TLS WG

[Johannes Merkle <[e-mail]>]

D. J. Bernstein wrote on 01.08.2014 03:36:
> However, the following recent analysis shows that the Brainpool curves,
> which were advertised as "generated in a systematic and comprehensive
> way" covering several different security levels, actually gave the curve
> generator the flexibility to secretly choose from among more than
> 1000000 curves for any particular prime:
> 
>    http://safecurves.cr.yp.to/bada55.html
>    http://safecurves.cr.yp.to/bada55/bada55-20140722.pdf

This statement is so skewed and misleading that I can not refrain from commenting:

- In this analysis, a significant part of this flexibility comes from the choice of the hash function. Specifically, the
BADA55 curves were generated using one of the numerous version of Keccak. However, Keccak wasn't even invented at the
time the Brainpool curves were generated.

 - The method used to generate the coefficients of the Brainpool curves was taken from ANSI X9.62 (including the use of
SHA-1), which was - at least at that time - the only reference for a method for pseudo-random curve generation. There is
only the slight deviation that the second coefficient was computed in exactly the same way as the first one, while ANSI
X9.62 computes the fraction of these, but this straightforward simplification does not introduce significant flexibility.

- Pi and e are by far the most prominent mathematical constants, while cosinus(1) (used in that analysis) is quite
arbitrarily chosen. Expressing Pi as 4*arctan(1) doesn't change this fact.

It is perfectly OK to point out that the Brainpool curves do not allow optimal performance, or that Montgomery and
Edwards curves allow simplified arithmetic. But it is not ok to imply that the Brainpool curves could potentially have
been designed with a backdoor built in. This suggestion is completely unjustified, misleading and gives a false color.

-- 
Johannes