Re: [TLS] Using Brainpool curves in TLS

[Manuel Pégourié-Gonnard <[e-mail]>]

On 17/10/2013 18:40, Nico Williams wrote:
> On Thu, Oct 17, 2013 at 11:25 AM, Manuel Pégourié-Gonnard
> <[e-mail]> wrote:
>> On 17/10/2013 17:55, Nico Williams wrote:
>>> The fact that some curve has twist
>>> security means that for DH there's no need to validate that public
>>> keys are points on the curve
>>
>> Not if your peer sends you (x, y). Your statement is true only in ECDH schemes
>> where the peers sends only x (and you don't attempt to find y).
> 
> Fair enough, but as the subject was Brainpool vs. Curve25519...

If I may reformulate my point: twist-security is relevant only for curves
suitable for use with schemes where only the x coordinate is transmitted, and no
attempt to reconstruct y is needed on the receiving side. Which means, curves
for which formulas exist for point multiplication using only the x coordinate.
To the best of my knowledge (read: after looking up the explicit formulas
database) no such formulas exist for short Weierstrass curves. Let's try with
pseudo-code:

If (has efficient x-only formulas)
	may transmit only x, and if doing so:
		if (is twist-secure)
			no need to validate x
		else
			need to validate x
else
	need to transmit or reconstruct y, so:
	if (y transmitted entirely)
		need to validate (x,y) explicitly
	else
		(x,y) implicitly validated while reconstructing y

As you can see, twist-security is irrelevant in the second branch, to which
short-Weierstrass curves (which can't be transformed to Montgomery form, such as
Brainpool curves) belong unless some magical x-only formulas are discovered.

So you may argue that Curve25519 has performance-without-sacrificing-security
advantages for DH over Brainpool curves and I certainly won't contradict you on
that point, but citing twist security as relevant here would be putting the cart
before the horse IMO.

Manuel.

PS: just kidding (almost?), but one could argue that brainpoolP384r1, as used in
TLS for ECDH now, is *less* secure because of twist-security, if people start
thinking that they don't need to validate public keys for this curve...