2
$\begingroup$

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe.

The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the security, how should we understand these?

I think this is valid for encrypting, but are these also valid for signing?

Improve this question
$\endgroup$
4
  • 7
    $\begingroup$ P256 is secure, it just lacks some nice-to-have features that make writing a fast and secure implementation easier. $\endgroup$ – CodesInChaos Oct 13 '17 at 7:11
  • $\begingroup$ Reading the article reminds me why we should not implement our own crypto but use libraries written by people who know what/how they are doing. $\endgroup$ – gusto2 Oct 13 '17 at 7:33
  • 2
    $\begingroup$ Claiming NIST curves as insecure but some obscure never–heard–of curves as secure is IMHO complete bullshit. $\endgroup$ – user27950 Oct 13 '17 at 15:02
  • $\begingroup$ As far as I know these attacks are for any use of the curve in crypto; i.e. it is not tied to any specific use case such as encryption / signing. $\endgroup$ – Maarten Bodewes♦ Jun 14 '18 at 11:47
4
$\begingroup$

Quoting CodesInChaos:

P256 is secure, it just lacks some nice-to-have features that make writing a fast and secure implementation easier.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.