Re: [TLS] Safe ECC usage

[Johannes Merkle <[e-mail]>]

> random prime instead of a special one incurs a computational cost.  So, I
> think I was reasonable to infer that Brainpool was implying that special
> fields were lacking in security.  (The implication against special values
> may then be inferred further.)  

The primes used by NIST curves are so special that there is less room for suspicion of a backdoor in the primes than in
the curve.

Our main concern with the special primes used by NIST curves is that their special form requires more caution to harden
your arithmetic against side-channel attacks. As a matter of fact, Sakai & Sakurai, for instance, have proposed power
analysis attacks targeting arithmetic on Pseudo-Mersenne primes. And we don't know, if the NSA has developed improved
side-channel attacks against ECC over such fields.

As I understand, the Curve25519 papers address side-channel immunity by specifying an eligible arithmetic. No objection
to that approach, but for the Brainpool curves we had a different one.

Another aspect was that we avoid many patents by not using Pseudo-Mersenne primes.



Johannes