Re: [TLS] Twist security for brainpoolp256r1

Manuel Pégourié-Gonnard <> Tue, 11 November 2014 21:55 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 382721ACEF4 for <>; Tue, 11 Nov 2014 13:55:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.397
X-Spam-Status: No, score=0.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_MISMATCH_COM=0.553, HOST_EQ_NL=1.545, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id H4cDnywQvvwK for <>; Tue, 11 Nov 2014 13:55:12 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 67F471ACEEF for <>; Tue, 11 Nov 2014 13:55:12 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=exim; h=Subject:Content-Transfer-Encoding:Content-Type:In-Reply-To:References:To:MIME-Version:From:Date:Message-ID; bh=7aTH2DevF2mChWtsugEiZpNi2Gx1mat6oo3kxRvDHEI=; b=jZFOHw+WCTpfQBayhvSLWuN4jH9a5Pen2FDVxGsHUzMJW5I27heNchC8L/1CMdDPfL7aiHUMo53mAJSQU8ZnaMw4Vz1gviv5/F2Xj1Ut28Ag96vNL3lyPikvEkdbZgJZirQDD21R3yJ6PIGzQVsyraaAvoCOeVp/Lx23dUd8umw=;
Received: from ([] helo=[]) by with esmtpsa (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <>) id 1XoJOw-00057D-Ee; Tue, 11 Nov 2014 22:55:02 +0100
Message-ID: <>
Date: Tue, 11 Nov 2014 22:55:07 +0100
From: Manuel Pégourié-Gonnard <>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0
MIME-Version: 1.0
To: Oleg Gryb <>, Johannes Merkle <>, "" <>
References: <> <>
In-Reply-To: <>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000)
X-SA-Exim-Scanned: Yes (on
Subject: Re: [TLS] Twist security for brainpoolp256r1
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 11 Nov 2014 21:55:13 -0000

On 11/11/2014 21:11, Oleg Gryb wrote:
> Thanks for explaining all that, but I just want to clarify it a bit further.
> What 2^44 means for the brainpoolP256t1 in DJB table?
It's the cost of an attack for an attacker who can force you to accept a point
that is not on the curve but on its non-quadratic twist.

In the context of TLS (with the currently available curves and point formats)
what safecurves calls "twist security" is totally irrelevant: either the
implementation validates that points are on the curve, or you're vulnerable to
an invalid curve attack which is much more powerful than a twist attack.

Any decent implementation (which includes OpenSSL and some others) of ECC with
TLS will check that points belong on the intended curve.

> The last question that I have is related to brainpool curves implementations in openssl.

This question is more suited to the OpenSSL list, as it is specific to this
implementation. This list is about the protocol.