Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can.

ARGH NO ARGH. ...

Bruce Schneier's suggestion comes after reading countless TS and secret documents. I'm going to go with his advice.



The premise of his statement is invalid. It's "not even" wrong. There are NIST ECC "constants" you might want to avoid, but there are other parameters you can use instead.


Perhaps. But the problem is that we don't actually know any specific way that NIST could have selected malicious ECC constants. So the problem is that whatever bad property they might have selected for may also exist in your randomly selected ones.


We actually know quite a bit about how NIST generated the random curves, since the methodology (which is based on hashing strings) is in the document that defines the curves.


Please reread my post, you seem to have misparsed it. I was not saying that we don't know how they were generated, you can see that I was posting otherwise at the same time elsewhere.


In theory, could NIST, with NSA's help, have used the "parallel construction" approach and generated "bad" parameters using a supposedly benign process?


Yes, in theory. But it would be difficult and risky.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: