Re: [TLS] Twist security for brainpoolp256r1

[Manuel Pégourié-Gonnard <[e-mail]>]

On 11/11/2014 21:11, Oleg Gryb wrote:
> Thanks for explaining all that, but I just want to clarify it a bit further.
> 
> What 2^44 means for the brainpoolP256t1 in DJB table?
> 
It's the cost of an attack for an attacker who can force you to accept a point
that is not on the curve but on its non-quadratic twist.

In the context of TLS (with the currently available curves and point formats)
what safecurves calls "twist security" is totally irrelevant: either the
implementation validates that points are on the curve, or you're vulnerable to
an invalid curve attack which is much more powerful than a twist attack.

Any decent implementation (which includes OpenSSL and some others) of ECC with
TLS will check that points belong on the intended curve.

> The last question that I have is related to brainpool curves implementations in openssl.

This question is more suited to the OpenSSL list, as it is specific to this
implementation. This list is about the protocol.

Manuel.