Subject: Re: [Cfrg] Query about ECDAA security

From: Dan Brown <[email-masked]>
Date: Fri, 24 Aug 2018 12:01:49 +0000

‎Minor indirect responses below.

  Original Message  
From: Peter Gutmann
Sent: Friday, August 24, 2018 6:08 AM
To: Ira McDonald; [email-masked]
Subject: Re: [Cfrg] Query about ECDAA security

and the use of BN curves (why those, of all possible curves you could choose?
If you want standards-compliance use P256, if you want standard-but-better-
than-P256 use brainpool256, and if you want trendiness use 25519).

Peter.
______________________________________________

What they want is a pairing, which the three alternatives you listed lack (unless you have a breakthrough :).

Personally, I doubt pairings were necessary to do what DAA claims to do, but that's only my intuition, and not worth much. (As usual, I can complain about its name..., too close to DSA, etc., is that intentional?)

---

From: Tony Arcieri <[email-masked]>
Date: Fri, 24 Aug 2018 07:02:21 -0700

> (unless you have a breakthrough :).

Regarding curves for pairings, I've seen a general desire to migrate off of
BN curves after the Kim-Barbulescu NFS paper:

https://eprint.iacr.org/2015/1027
https://ellipticnews.wordpress.com/2016/05/02/kim-barbulescu-variant-of-the-number-field-sieve-to-compute-discrete-logarithms-in-finite-fields/

See also:

https://eprint.iacr.org/2016/1102.pdf

Advances in NFS for pairings-based curves resulted in an effective security
reduction for BN256 to ~100-bits, well below the 128-bit level it was
previously assumed to have.

BLS12-381 is a new curve for pairings with a higher security level that
attempts to address some of these concerns (at the price of performance):

https://eprint.iacr.org/2017/1050.pdf

> Personally, I doubt pairings were necessary to do what DAA claims to do,
> but that's only my intuition, and not worth much. (As usual, I can complain
> about its name..., too close to DSA, etc., is that intentional?)

With a lot of tradeoffs, ring signatures can accomplish many of the same
properties. That said, I don't think it's terribly uncommon to use pairings
for these sorts of applications. See also EPID group signatures as used by
Intel SGX:

https://eprint.iacr.org/2009/095.pdf

-- 
Tony Arcieri