Timeline for Which SafeCurves critics about Brainpool twisted curves apply to the corresponding random curves?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 20, 2023 at 21:35 | comment | added | poncho | @Ruggero: actually, field additions are comparatively cheap and so checking your $x,y$ values is more like 3 field multiplications... | |
| Dec 20, 2023 at 21:00 | comment | added | kelalaka | cr.yp.to/bib/2003/joye-ladder.pdf | |
| Dec 20, 2023 at 20:40 | comment | added | Ruggero | @MehdiTibouchi and by the way I think even "twist" is not a fair criticism. They need °twist" for X25519 as they can't do point check because the y is not transmitted/used. An input point check, which was popular before SafeCurves, eliminates any reason to have twist security and it costs like 7 field operations. | |
| Dec 20, 2023 at 20:36 | comment | added | Ruggero | @kelalaka Thanks. I've added a mention a link to the complete formulas paper | |
| Dec 20, 2023 at 20:35 | history | edited | Ruggero | CC BY-SA 4.0 |
added mention to complete formulas for SW curves, added small section challanging the validity of safecurves result
|
| Dec 20, 2023 at 20:29 | comment | added | Ruggero | @MehdiTibouchi I completely agree that Safecurve is a publicity stunt, I will edit to add that. That said in the "ladders" description they don't consider the Brier-Joye ladder as valid because it's not as fast as the Montgomery ladder and "creates a conflict between efficiency and security". I guess the same could be argued against the complete formulas. | |
| Dec 20, 2023 at 14:29 | comment | added | kelalaka | Is there any "exception-free" coordinates system for Weierstrass curves? | |
| Dec 20, 2023 at 12:01 | comment | added | Mehdi Tibouchi | Other than "twist", which is a fair criticism, all other properties are arguably satisfied by Brainpool curves (there are ladder algorithms, complete addition laws and randomized representation techniques on prime order curves too). It's just the outdated/deliberately restrictive definition of "SafeCurves" that prevent them from applying. Not that I would necessarily recommend Brainpool curves either, but one has to remember that "SafeCurves" is a bit of a publicity stunt. | |
| Dec 20, 2023 at 11:52 | vote | accept | fgrieu♦ | ||
| Dec 20, 2023 at 9:52 | history | answered | Ruggero | CC BY-SA 4.0 |