4 ms·

Tin-foil-hat reason: it has been shown that there exist a set of numbers with a particular relationship to the elliptic curve numbers, and that it is possible t

by elehack 14y ago

Tin-foil-hat reason: it has been shown that there exist a set of numbers with a particular relationship to the elliptic curve numbers, and that it is possible that whoever generated the elliptic curve numbers may also have generated the other set of numbers, which basically form a skeleton key to ECC. Schneier on the attack: http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115 http://www.wired.com/politics/security/commentary/securityma...

dchest 14y ago
Isn't this the case for almost any cryptosystem? There's JP Aumasson's paper on the possibility of hash backdoor: http://www.131002.net/data/papers/Aum11a.pdf http://www.131002.net/data/papers/Aum11a.pdf
- tveita 14y ago
  Not for RSA. It's highly unlikely that anyone has hidden a backdoor in the set of primes. They'd have to solve the RSA problem, which is believed to be difficult. When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria. Edit: these is also called "nothing up my sleeve numbers".
  - dchest 14y ago
    There are methods of embedding backdoors into the RSA key generation scheme, though (e.g. http://crypto.cs.mcgill.ca/~crepeau/PDF/CS02.pdf http://crypto.cs.mcgill.ca/~crepeau/PDF/CS02.pdf). When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria. The initialization constant in SipHash is awesome: "somepseudorandomlychosenbytes".
    - tveita 14y ago
      Right, but that would be a backdoor in that particular implementation. If you implement RSA yourself, you're safe from backdoors. (With the usual caveats about compilers, operating system and hardware.) The insidious thing about cryptographic backdoors is that they're embedded in the specification itself. Any conforming implementation will be vulnerable.
harshreality 14y ago
That's a problem with the Dual EC PRNG, one of four PRNGs in NIST SP 800-90, not a "skeleton key to ECC" generally. Given the horrible performance of that PRNG, I wonder if anyone implements it, securely I would hope (with random point generation rather than using the "recommended" possibly insecure points).

by elehack 14y ago

dchest 14y ago

Isn't this the case for almost any cryptosystem? There's JP Aumasson's paper on the possibility of hash backdoor: http://www.131002.net/data/papers/Aum11a.pdf http://www.131002.net/data/papers/Aum11a.pdf

tveita 14y ago
Not for RSA. It's highly unlikely that anyone has hidden a backdoor in the set of primes. They'd have to solve the RSA problem, which is believed to be difficult. When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria. Edit: these is also called "nothing up my sleeve numbers".
- dchest 14y ago
  There are methods of embedding backdoors into the RSA key generation scheme, though (e.g. http://crypto.cs.mcgill.ca/~crepeau/PDF/CS02.pdf http://crypto.cs.mcgill.ca/~crepeau/PDF/CS02.pdf). When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria. The initialization constant in SipHash is awesome: "somepseudorandomlychosenbytes".
  - tveita 14y ago
    Right, but that would be a backdoor in that particular implementation. If you implement RSA yourself, you're safe from backdoors. (With the usual caveats about compilers, operating system and hardware.) The insidious thing about cryptographic backdoors is that they're embedded in the specification itself. Any conforming implementation will be vulnerable.

harshreality 14y ago

That's a problem with the Dual EC PRNG, one of four PRNGs in NIST SP 800-90, not a "skeleton key to ECC" generally. Given the horrible performance of that PRNG, I wonder if anyone implements it, securely I would hope (with random point generation rather than using the "recommended" possibly insecure points).