I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition that I can grasp. The definition I found is on page 65 of SP 800-90A. Just to be clear, I'm referring to the $\phi$ found in this diagram.

Can anyone explain what this function does exactly? Is it a common function in elliptic curves? Something in number theory that's just over my head? Any help would be much appreciated.

  • $\begingroup$ You are almost surely aware of it, but in case you weren't and were considering to use Dual_EC_DRBG - don't, it's backdoored by the NSA. $\endgroup$ – orlp Dec 3 '13 at 5:45
  • $\begingroup$ @nightcracker Thanks. Fully understanding the back door is actually the reason for my interest in Dual_EC_DRBG. $\endgroup$ – Bill Dec 3 '13 at 5:51
  • $\begingroup$ Another resource on the backdoor: rump2007.cr.yp.to/15-shumow.pdf $\endgroup$ – pg1989 Dec 3 '13 at 7:33
  • 1
    $\begingroup$ On p. 65: "$\phi(x)$ maps field elements to non-negative integers, taking the bit vector representation of a field element and interpreting it as the binary expansion of an integer." You should explain what's wrong with that explanation. $\endgroup$ – K.G. Dec 3 '13 at 7:46
  • $\begingroup$ Another resource on the backdoor and how to exploit it: jiggerwit.wordpress.com/2013/09/25/the-nsa-back-door-to-nist (I think this was the most clear article I read on the subject) $\endgroup$ – ddddavidee Dec 3 '13 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.