Re: [TLS] Safe ECC usage

[Johannes Merkle <[e-mail]>]

Dan Brown schrieb am 17.10.2013 17:46:
> Why couldn't a new attack just work on one curve, namely Curve25519?  If I 
> understand correctly, DJB has argued that the ECC theory and experience would 
> be evidence for a claim similar, but perhaps not as strong, as your claim.
> 

There is really no use in speculating about future attacks as long as there are not some clear indications about their
presence and potential. An example of the latter case is the anticipation (or is is merely a feeling in the guts?) by
some researchers of an attack potential for certain curves having small class group orders, and even the validity of
this educated guess is controversially disputed.

Nobody knows which curves unforeseen attacks (I mean to exclude the latter example by this term) will affect. IMO any
speculation about this (including the present discussion) is metaphysics.

BTW, my understanding of DJB posts was that he only meant to contradict your hypothesis on certain curves being more
likely being affected by future attacks than others, but as far as I understood, he never made any claim about the
impact to be expected by future attacks.
-- 
Johannes