2
$\begingroup$

I'm using brainpoolP512r1 elliptic curve for DSA and DH in my application. Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure. Unfortunately my curve wasn't mentioned.

When I'm using brainpool, my public keys encoded in base64 have around 210 chars, but for curve25519, they expand into 410 chars which causes a few problems. How can I verify if brainpoolP512r1 is safe?

$\endgroup$
  • 6
    $\begingroup$ The definition of "safe" the safecurve website uses is rather peculiar. It's mainly about how easy it is to produce a correct implementation and less about the security of a correct implementation of said curve. So just because a curve doesn't fulfill their criteria, you should not conclude that it's not secure. $\endgroup$ – CodesInChaos Jul 2 '16 at 17:47
  • $\begingroup$ There is no secure / not secure possible. You'll have to prove the curve secure for your specific use and by performing certain checks on e.g. public keys. I'm not sure what curve25519 has to do with your question; I can however guess that it is encoding all the domain parameters instead of using an OID to identify the curve. That OID seems to be 1.3.6.1.4.1.11591.15.1 by the way. $\endgroup$ – Maarten Bodewes Jul 2 '16 at 17:47
  • $\begingroup$ Don't worry ! Brainpool curves are fine. The electronic passport uses them too. $\endgroup$ – user27950 Jul 2 '16 at 17:50
  • $\begingroup$ See also: crypto.stackexchange.com/questions/17780/… $\endgroup$ – otus Jul 2 '16 at 17:55
  • 2
    $\begingroup$ @Cryptostasis That in itself should not be enough reason to trust the curves. $\endgroup$ – Maarten Bodewes Jul 2 '16 at 18:13
10
$\begingroup$

Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure.

Actually, that website doesn't say that, it says they aren't safe, where their definition of "safe" means it meets all of a series of requirements.

If you go through the table they give, brainpoolP384t1 fails the safe requirements at three points:

  • ladder; there is a fairly simple algorithm for doing point multiplication for certain curves; this algorithm is moderately fast, and also tends to be resistant to timing and cache-based side channel attacks (but not DPA-style attacks); that algorithm as listed doesn't work for brainpoolP384t1 (actually, it does, it's just a bit more complicated). One can certainly make the case for simplicity; however just because a curve doesn't implement it as easily as others doesn't necessarily mean that the curve can't be implemented securely.

  • complete; does the curve allow the implementation of a point addition algorithm that works without branches in all cases (point doubling, adding the neutral element); brainpoolP384t1 does not (at least, not without complicating the algorithm). However, some point multiplication algorithms don't require unified addition/doubling algorithms and avoid the neutral element; again, simplicity is a good goal, however just because a curve doesn't allow this specific simplification doesn't mean that it's not secure.

  • indistinguishability; is the representation of a point distinguishable from random; for brainpoolP384t1, it is. On the other hand, unless you're implementing a PAKE, that's usually not important (and even with PAKE, there are ways around it), and a curve can not implement this, and still be considered secure.

I believe that brainpoolP512r1 has the same properties, and so this page needn't be considered evidence that it isn't secure.

As for whether it is secure, well, the best I can say is "there's no known cryptanalytic result suggesting that it is not" (which is ultimately the best we can say about most cryptographic algorithms).

When I'm using brainpool, my public keys encoded in base64 have around 210 chars, but for curve25519, they expand into 410 chars which causes a few problems.

Now, that sounds odd; a curve25519 ECDH and EdDSA (you can't use standard ECDSA with curve25519, at least, not with the ladder algorithm) have public keys of 43 bytes (Base64 encoded); it sounds like you're doing something wrong here.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.