Re: [TLS] Using Brainpool curves in TLS

[Johannes Merkle <[e-mail]>]

Manuel Pégourié-Gonnard schrieb am 16.10.2013 16:25:
> On 16/10/2013 15:32, Tom Ritter wrote:
>> I'm not sure I agree with them fully, but I also don't have very much
>> context. (My thoughts when reading that is "Why sqrt(2) and sqrt(3)
>> instead of pi and e - what makes those constants more trustworthy?")

Also, Pi and e as transcendental numbers seem more "unstructured" as any (square or higher-order) root. Just imagine an
imaginary hash function taking as a first step the square of the input string taken as integer. Surely, SHA-1 does not
work this way but the "unstructuredness" of transcendental numbers seems more robust against any kind of arithmetic
processing.

> This is obviously not a security concern unless you believe there is a class of
> weak curves with quite high density, which would IMO be very bad news for ECC in
> general, not only these particular curves.

In support of this argument let me summarize my answers to the assessment on http://safecurves.cr.yp.to/rigid.html

Q: Why SHA-1 instead of, e.g., RIPEMD-160 or SHA-256?
A: Procedure follows ANSI X9.62

Q: Why use 160 bits of hash input independently of the curve size?
A: 160 bit is the minimal amount of input entropy needed to allow maximum entropy n the hash value.

Q: Why pi and e instead of, e.g., sqrt(2) and sqrt(3)?
A: Most mathematicians will acknowledge that pi and e are more fundamental than sqrt(2) and sqrt(3). Furthermore, as
transcendental numbers they are more robust w.r.t the "unstructuredness" of their decimal representation.

Q: Why handle separate key sizes by more digits of pi and e instead of hash derivation?
A: Follows the KISS principle. But, yes, there was a very small degree of freedom.

Q: Why counter mode instead of, e.g., OFB?
A: Counter mode? We didn't use block ciphers. If you refer to the counter used in computation of hash values, this
follows ANSI X9.62.

Q: Why use overlapping counters for A and B (producing the repeated 26DC5C6CE94A4B44F330B5D9)?
A: I admit that this is unfortunate. And yes, there was a very small degree of freedom.

Q: Why not derive separate seeds for A and B?
A: Yes, there was a very small degree of freedom.

You see, there is not much freedom in the choices made, which implies that implanting a back door would have required  a
very large class of weak curves or great luck.

-- 
Johannes