Re: [saag] Possible backdoor in RFC 5114

[Yoav Nir <[e-mail]>]

> On 29 Mar 2017, at 11:50, Ben Laurie <[e-mail]> wrote:
> 
> 
> 
> On 22 March 2017 at 18:20, Watson Ladd <[e-mail] <mailto:[e-mail]>> wrote:
> 
> 
> On Mar 22, 2017 8:15 AM, "Ben Laurie" <[e-mail] <mailto:[e-mail]>> wrote:
> 
> 
> On 7 October 2016 at 16:56, Yoav Nir <[e-mail] <mailto:[e-mail]>> wrote:
> 
> > On 7 Oct 2016, at 16:59, Tero Kivinen <[e-mail] <mailto:[e-mail]>> wrote:
> >
> > Stephen Farrell writes:
> >>
> >> So I'm not seeing anyone so far argue to not
> >> deprecate these somehow.
> >>
> >> We could just make 5114 historic as Yoav suggests,
> >> or, if someone writes an I-D to explain why, we
> >> could obsolete 5114. (Such an I-D would presumably
> >> also say something about codepoints that point at
> >> 5114 from other registries.)
> >>
> >> Assuming nobody shows up saying these are in
> >> fact in widespread use I'd be supportive of us
> >> getting rid of cruft.
> >
> > I think the NIST ECP groups are quite widely supportd, and used.
> > RFC5114 includes both Nist ECP Groups (192, 224, 256, 384 and 521) and
> > 3 MODP groups.
> >
> > In IPsec, ECP groups are widely used, those MODP groups with subgroup
> > are not. On the other hand I think only those 192, 256 and 521 bit
> > groups are really used, and those are defined also in RFC5903 (which
> > obsoleted original 4753 which had serious bug in it).
> 
> 
> First, I think you meant 256, 384 and 521 bit, not the 192.
> 
> Second, 5114 did not fix the bug in 4753. It just referenced 4753 for formatting. You know this better than I do, but I don’t think the IANA registry ever referenced 5114 for these ECP groups.
> 
> So for the three useful groups in 5114 you didn’t need it (as 4753) already existed, and you don’t need it now, as 5903 exists. I don’t see anything standing in the way of moving to historic or obsoleting it.
> 
> Possibly I missed something here: why should we be any happier about 5903 than we are about 5114?
> 
> Can you prepare a backdoored elliptic curve that passes all acceptence critera?
> 
> No, but can the NSA?

I don’t know, but we can speculate all day about what the NSA can or cannot do, including wandless magic or generally solving the DLP. We can only make decisions on the basis of what we know or can reasonably project.

Yoav