Re: [saag] Possible backdoor in RFC 5114

On Oct 8, 2016 7:40 AM, "Dang, Quynh (Fed)" <quynh.dang@nist.gov> wrote:
>
> Assuming the curves generator was a bad guy and he/she could do 2^80
computations (not simple computations: running the specified routine to
find primes numbers which means he/she got to do more than 2^80 times of
the routine by a factor) at that time in 1997, the class of weak curves
must have been about 2^169 in 1997, only known to the NSA and have never
been discovered by the public from 1997 until now.
>
>
> Also, some of the curves are used for top secret security level
information. If it was the case that the NSA knew the curves were weak
curves, would they take that risky action by assuming that the rest of the
world would not find that out for at least 20 years later.

Am I discussing ECC? No.

>
>
> Quynh.
>
> ________________________________
> From: Watson Ladd <watsonbladd@gmail.com>
> Sent: Saturday, October 8, 2016 9:37:24 AM
> To: Dang, Quynh (Fed)
> Cc: saag@ietf.org
> Subject: Re: [saag] Possible backdoor in RFC 5114
>
>
> On Oct 8, 2016 5:30 AM, "Dang, Quynh (Fed)" <quynh.dang@nist.gov> wrote:
> >
> > Watson and all,
> >
> > This paper would be a good (re)read:
http://www.math.uwaterloo.ca/~ajmeneze/publications/pqc.pdf.
>
> From which you would have us conclude what?
>
> The backdoor of Gordon in Diffie-Hellman is well-known.  There is no way
to know if these primes are backdoored.
>
> >
> > Quynh.
> >
> > ________________________________________
> > From: saag <saag-bounces@ietf.org> on behalf of Watson Ladd <
watsonbladd@gmail.com>
> > Sent: Thursday, October 6, 2016 11:56 AM
> > To: saag@ietf.org
> > Subject: [saag] Possible backdoor in RFC 5114
> >
> > https://tools.ietf.org/html/rfc5114
> >
> > Let's review some publicly known facts:
> >
> > 1) BBN is a defense contractor
> >
> > 2) The NSA subverts crypto standards
> >
> > 3) It is possible to design primes so the discrete log problem is easy
> >
> > 4) The primes in RFC 5114 are not generated in verifiable manner: it
> > is possible they
> > are hidden SNFS primes.
> >
> > At minimum we should obsolete RFC 5114 in favor of primes generated in
> > a verifiable manner. The fact that there already were primes for IKE
> > use makes me wonder why this was even needed in the first place.
> >
> > Sincerely,
> > Watson
> >
> > _______________________________________________
> > saag mailing list
> > saag@ietf.org
> > https://www.ietf.org/mailman/listinfo/saag