Re: [TLS] Using Brainpool curves in TLS

[Watson Ladd <[e-mail]>]

On Tue, Oct 15, 2013 at 9:12 AM, Nico Williams <[e-mail]> wrote:
> On Tue, Oct 15, 2013 at 10:49 AM, Watson Ladd <[e-mail]> wrote:
>> The implementation in PolarSSL has a nonconstant pattern of memory
>> access. Seriously, it isn't 1999 anymore: everyone doing cryptography
>> should be aware of these issues.
>
> Indeed, constant-time operation is a very big deal.  A curve could be
> perfectly secure in the ECDLP sense and yet be utterly insecure due to
> side channels.  There are no standard curves that we can trust to be
> secure in both senses; DJB's curves are very likely secure enough in
> the ECDLP sense (certainly given current *public* research) and they
> are secure in the other sense; they are also quite fast.
Note Bena: Being safe against side channels is a property of the
implementation, not the curve.
DJB's implementations are constant time, and the curves have
properties that make it easier to be constant time,
but it is trivial to introduce backdoors into implementations of them.
> http://safecurves.cr.yp.to/
>
> Nico
> --



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin