Re: [Cfrg] [CFRG] Safecurves v Brainpool / Rigid v Pseudorandom

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 13/01/2014 23:07, Dan Brown wrote:

> For a given field, pseudorandom curve better resists secret
> attacks than rigidity.

With respect, I disagree.

With zero knowledge of a hypothetical attack, we have zero knowledge
about what may, or may not, be affected by it.


A point to note here: brainpoolP256r1 has a _very_ weak twist
(ρ @ 2^44) - a practical problem only in a flawed implementation that
doesn't check for invalid points. But here nevertheless, we actually
have a curve generated in a documented pseudorandom manner, yet has at
least one desirable property distinctly less secure than all of its
tested peers.

Why? Bad luck, it seems.


I for one prefer sound, well-explained, reproducibly verifiable curve
design which resists all known attacks, to rolling the dice and hoping
it resists a hypothetical attack that we know nothing about.

Hence my preference for the "Safecurves" approach, and thus the
"Chicago" curves.

That some of them can be (and have been) implemented in an extremely
efficient way, and thus are exceptionally well-suited for the
important task of accelerating wide adoption of forward security in
internet protocols, I also find a highly desirable point in their
favour - as, it seems, do many others.

I can find no remotely compelling argument against them.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJS1IRQAAoJEOyEjtkWi2t65NgP/AuNRjkkXic7aB9A+Ybb0fiB
3fy6W5gjuuvV9ggiSRvoOhPPpCjCNulJeQk9xkakxw7RpovFCmk2XA8WmebE0+sn
ITlAssXcsn8iT8jqeBPGUydo21Orqr1IzP8ozpgbcm0XsmDCoEWjyQT1E/Ez2vOg
BSrybbwfFsDR92pBQ6ESP7s+rxojPWzGaBg5EPIekl3I4vZ+guT1H1bOdqVFn0x5
OIIyDe9iLV7p8GwfRIfWaBY1Cpq7qwya7SbfWgzeQNVEkCVQuOOA+ep9CBo0XXsR
86Tc0ncRjwcX+ak6WlAUKofn1teChGrJnb734HGMGY8MB2vyyVJlgaCFCAiUaQMw
K3eS25SwwNw/G2NMIQ5yrzW6VXO2Abw9aYpM+5+JjNdHOcSXyRpAtVFshw7p3du/
0gO/Cv/gpQe1igBA24/lF31cADsPeliyfe0w2n7zXx1yaL9RfzgJpuW/K0LIUEbh
Y8aoCMBVFvtLbIx/nzZlbgORRX6jeTg+Q1IBxU9mxl1OtBB+eLqjaK54L80JDM4k
y7+xMcGq5e0n4RIzRjVTdWh0mmxpvgHxnAqt0bdsRZyXUrsEqSLatgd4mc7n88zY
cIPd71wp/pf6GYKepwRwMdhfEKjtJR0DJve0/OipkA+x87rnquPtE8xkSJNL/T3a
CcaoN5H/vJCsyxwRNZKn
=oemM
-----END PGP SIGNATURE-----