Subject: [Cfrg] Random curves according to Auerbach--Bellare--Kiltz

From: Dan Brown <[email-masked]>
Date: Mon, 8 Jan 2018 18:18:58 +0000

Dear CFRG,

In https://ia.cr/2018/023 (and IACR-PKC-2018?), Auerbach, Bellare and Kiltz describe using random curves to avoid the threat of subverted parameters.

I've not yet read the whole paper, so am only 10% sure what they're really proposing.  

The gist seems to select a random curves at the time one generates a public key, for PKE or KEM, etc.  I'm not sure they propose doing SEA for each curve, or just to eliminate curves with too many small-order points.  Presumably, the ephemeral side needs to be able to implement an arbitrary curve (over a fixed field, or a fixed field size, etc.).  This would slow down some steps, but might still be fast enough for some IETF applications.

I don't see (at all) how this address signatures and PKI issues (PKE and KEM rely on some kind of trust), so the (theoretical) threat of subverted parameters still remains.

Best regards,

Dan Brown

PS: it's still on my to-do (/overdue) list to describe here how I would choose fixed pseudorandom parameters (in ECC or elsewhere).