Re: [TLS] Using Brainpool curves in TLS

[Watson Ladd <[e-mail]>]

On Tue, Oct 15, 2013 at 7:52 PM, Martin Rex <[e-mail]> wrote:
> Nico Williams wrote:
>>
>> > but it is trivial to introduce backdoors into implementations of them.
>>
>> Do you mean that it's easier to backdoor implementations of specific
>> EC curves than, say, RSA?  I would think that implementations of...
>> just about anything can be backdoored with relative ease.
>
> I assume that he might have meant what is also indicated on the
> referenced Web Site http://safecurves.cr.yp.to/
> that it is extremely difficult to implement ECC and _NOT_ hang yourself,
I mean exactly what I said: no more and no less. Implementations must
be carefully
audited to establish freedom from side-channels, no matter what
primitive they implement.
>
> It would not surprise me at all if the vast majority of ECC
> implementations would be found to be vulnerable to serious
> weaknesses, when carefully analyzed, and that the problems found
> in the RSA part would be *MUCH* smaller in comparison.
I really do not know how one is supposed to measure this, or why it matters.
A few well-audited implementations designed for maximum clarity should suffice
for all most all purposes.
>
> -Martin



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin