Discussion
this paper is so funny [cw djb] https://cr.yp.to/papers/safecurves-20240809.pdf it starts off trashing DH, even though ECC and DH do not solve the same problem. then it gets incredibly cagey about prime fields:
There are other types of elliptic curves. In particular, there are many ECC papers that consider elliptic curves over non-prime finite fields. However, the SafeCurves criteria require prime fields.
like what i constantly want to know is whether i can use a length-N bit string as a finite field of size 2N and then just use normal computer arithmetic over it. but instead of explaining anything he'll just start dropping lines like this:
quantitatively, security levels are reduced by about 20% when the polynomial has small coefficients.
this is not a serious thing to say and this paper should never have been published!
One can find standards as late as 2001 saying that “the computation of a single elliptic curve discrete logarithm has the effect of revealing a single user’s private key. The same effort must be repeated in order to determine another user’s private key”. The second sentence is incorrect: the effort is reduced for each subsequent key.
absolutely no discussion of what information is used to calculate the discrete logarithm against. dude is just saying shit!
then he goes on a tangent about AES like that has anything to do with elliptic curves??? and then there's an NSA section which is just fully incomprehensible
i think this line describes the purpose of the paper effectively:
In short, these failure cases are another source of tension between simplicity and security.
simplicity is security. this is a terrible thing to impart to protocol designers
Install bonfire.cafe
Get the full app experience
