Re: [TLS] Safe ECC usage

[Watson Ladd <[e-mail]>]

On Wed, Oct 16, 2013 at 12:36 PM, Dan Brown <[e-mail]> wrote:

> Based on this score, if I had to guess what the next attack would be, then I
> would guess special.  An attack on random would be a breakthrough.
> Therefore, trying to choose a random curve is a best guess approach.
>

>> I say that it's a good idea to narrow the distribution even more, in
>> fact down to a single curve, by taking the _smallest_ curve coefficient
>> within the usual massively biased distribution. That's what Curve25519
>> does. This isn't just a performance win; it also prevents the sort of
>> manipulation that's clearly possible for someone who claims to be
>> "randomly" choosing curves from the wider distribution.
>>
>> Now imagine that there's no manipulation. How does this single-curve
>> distribution compare in security to the larger (massively biased)
>> distribution against some unknown attack? The correct answer is that we
>> have no idea---maybe it's more secure, maybe it's less secure, maybe
>> it's the same.
>
> Uncertainty, "no idea", about unknown attacks is a given, but we should
> still try to resist them, even if that means making assumptions and
> guessing.  Provably secure algorithm try to do this.  Previously unknown
> attacks are known pop up, occasionally.   But, we also give weight to the
> effort that people have exerted in trying to find attacks, to infer the
> unlikelihood of new attacks being discovered.
>
So you agree that E(random curve falls to unknown attack)=E(Curve25519
falls to random attacks). (This is is obvious unless
cosmic conspiracy happens, and if it isn't, think about it). But now the
question is whether the author of the random curve really picked it at
random, vs specified a curve. And then the fact that DJB specified at
most 17 bits or so is very important: a new attack would have to work
on 2^{-17} of all curves to work on Curve25519.
Sincerely,
Watson Ladd

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin