Re: [Cfrg] Hardware requirements for elliptic curves

[Ilari Liusvaara <[e-mail]>]

On Mon, Sep 15, 2014 at 05:43:19PM +0200, Lochter, Manfred wrote:
> __________ ursprüngliche Nachricht __________
> 
> Von:		Alyssa Rowan <[e-mail]>
> 
> > and the sheer cost-multiplication 
> > potential of a proposal to mandate the option of using
> > relatively-inefficient crypto near-universally across the web - including
> > at CDN scale!?
> 
> What is your measure for inefficiency? Cost per Signature? Or time per 
> signature? Or something different? Relatively to what?

Both cost per signature and cost per verification of signature. Can fairly
easily be 2x cost.

And nobody wants that sort of cost, unless 1) Legally mandated to. 2) Having
to interoperate.

And nobody is proposing to remove the Brainpool codepoints from TLS. Special
servers that communicate with smartcards or whatever (most don't!) can
implement those.

Having to implement random curves would be RFC6919 "MUST (but we know you
won't)".

> >
> > If your hardware is truly securely flexible, then you can adapt with no
> > trouble; if it's not flexible enough to securely work with efficient sparse
> > primes that also perform well in software, well, you probably need to
> > consider at least updating it so it is (how is it with the NIST "Solinas
> > primes"? Equally bad, one would have thought? Yet they're the most deployed
> > by far...).
> 
> This is not a hardware question. Actually the problem is that curves over 
> special primes need more SCA countermesures. This is also true for software 
> running on a general purpose processor.

One problem here is that general purpose CPUs are hugely complex, so it is
very difficult to know how various operations affect side channels like EM
or PA. But withstanding software-only attacks (and that goes far beyond
global timing) is likely a huge help here.

And those software-only attacks are not jokes. Modern CPUs and OSes tend
to be extremely vulernable.

Special-purpose crypto chips can at least be designed at hardware level to
reduce SCA attacks (sometimes well, sometimes badly).



-Ilari