3
$\begingroup$

For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast.

However, the 128bit security of Ed25519 is sometimes too strong to comply with export regulations.

So I wonder if there are any weaker curves of the same type (i.e. also patent-free and fast) that I can use instead? (or should I go deeper into ECC and try to determine myself the parameters of such a curve?)

$\endgroup$
  • $\begingroup$ Which export regulations? $\endgroup$ – Bristol Apr 14 '15 at 12:36
  • $\begingroup$ @Bristol : In the Wassenaar arrangement (dual-use list - cat. 5 – part 2 – "information security") it says "Discrete logarithms in a group other than mentioned in 5.A.2.a.1.b.2. in excess of 112 bits (e.g., Diffie-Hellman over an elliptic curve);" $\endgroup$ – Chris Apr 14 '15 at 12:47
  • 5
    $\begingroup$ @Chris Why use crypto at all, if its extremely weak? 56 bits of security is rather dubious. You should rather figure out how to comply with the export regulations of your country. Some countries (like Germany) don't care at all. In the US you need to jump through a couple of bureaucratic hoops, but shouldn't be too difficult. $\endgroup$ – CodesInChaos Apr 14 '15 at 14:52
  • $\begingroup$ @CodesInChaos : I can then put a demo online without worrying who is downloading the stuff. Further, I also use temporary Pederson commitments and zero-knowledge proofs to ensure that participants do not cheat in a multi-party protocol. An attacker would have to falsify the commitment during the execution, and I think that even a weak curve can provide a few seconds of security. :) But I will also follow your recommendation and try the bureaucratic route. Thanks! $\endgroup$ – Chris Apr 14 '15 at 16:33
  • $\begingroup$ Most countries in the Wassenaar arrangement have relaxed export rules for "mass-market" encryption hardware and software, as such rules are required for the modern Internet to work at all. From the US for instance, you only have to avoid exporting common stuff like this to the 5 "rogue states" or to terrorists. $\endgroup$ – Michael Hampton Apr 14 '15 at 19:42
6
$\begingroup$

You could try the 112-bit secp112r1 cited in [1].

Before you do this, the problem with that paper is they actually show how to break the discrete log problem on this curve! And this was back in 2012. So any export-strength implementation of ECC is definitely breakable by governments, research groups and sufficiently determined/resourceful commercial adversaries.

So you'd be selling crypto that, while safely exportable, is known to be breakable and you're competing against other crypto libraries that don't have this "feature". I'm skeptical whether this is a sensible idea.

EDIT: oops, I forgot to check the key point - that it's patent-free. But the problem remains that any 112-bit curve, patented or not, is small enough that one can feasibly if not easily take discrete logs.

EDIT2: on my machine, openssl ecparam -list_curves includes secp112r1 and according to [2] sun wrote the OpenSSL ECC package "precisely to avoid any patented method". To me it looks like you should be fine with that curve as long as you don't re-implement it using any of the patented implementation techniques. This is not legal advice of course.

[1] http://lacal.epfl.ch/files/content/sites/lacal/files/papers/noan112.pdf

[2] https://security.stackexchange.com/questions/3519/can-ecc-be-used-without-infringing-on-patents

$\endgroup$
  • $\begingroup$ Its a pity that the curve is broken already, but I think it can still be very useful. For instance, I can put a weakened demo version of my application online, without having to worry about potential legal problems. Thank you! $\endgroup$ – Chris Apr 14 '15 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.