Re: [Cfrg] NUMs/rigidity security (Re: [CFRG] Safecurves v Brainpool / Rigid v Pseudorandom)

[David McGrew <[e-mail]>]

Hi Adam,

On 01/16/2014 07:04 AM, Adam Back wrote:
> You know in principle we ought to stick to something with low entropy for
> the NUMs/rigidity seed.  I commented previously for example that 
> someone can
> do a fair bit of grinding by building a catalog of headlines, quote
> dictionaries, and permuting their punctuation, white space etc. Also
> permuting arbitrary implementation choices (encoding, endianness, equally
> plausible rigid choices, etc) So possibly the digits of pi are more
> convincing than some obscure literary quote or a headline.  The point 
> is to
> start from an ungrindable starting point, with canonicalized choices 
> at each
> step.  I think so far the NUMS argument is probably gamable to a 
> non-trivial
> extent due to the above effects.
>
> ie for secure NUMs you actually need to canonically encode all fo the
> arbitrary choices in a standardized language, sort them, and select the
> arbitrary choices at all levels, using the deterministic PRNG seed off 
> pi. And even the PRNG design itself needs to be standardized, 
> otherwise its
> design variants also admit yet more bits.
>
> The NUMs argument is good but so far is probably itself gameble, we 
> need a
> NUMs standard to remove as many of those variabilities as possible.
>
> Adam

I think this is right.   In my comment about using a hash of the S&P 500 
prices on some future date, I had assumed that the canonicalization step 
would be fixed in advance, and used unchanged when trading closed on 
that day.    (My thinking: those prices are easily accessible in the 
public record, and would be implausibly expensive to manipulate, and are 
not under the control of any government.  There might be better 
examples, but I couldn't think of any.)

I agree that using the digits of pi is in some sense more appealing.   
With the hash-of-prices approach, and people could come along after the 
curve group had been generated and call into question whether the 
canonicalization had actually been fixed beforehand.   Using the digits 
of pi would avoid this (mis)perception issue.

Off topic: you mention obscure literary quotes, and this one comes to 
mind.   "How I need a drink, alcoholic of course, after the heavy 
lectures involving quantum mechanics".   Which is of course just a very 
arbitrary encoding of another bit of information ...

David