Hacker News Reader

Comment by tptacek | Hacker News Reader

No, it's true, you get the choice between RSA and terrifying NIST ECDSA on the terrifying NIST P- curves.

There's still the 25519 curve, whose constants are highly constrained around reasonable criteria. DJB most probably haven't put any backdoor in those.

Plus, as far as big number arithmetic goes, it's relatively easy to implement.

I just want to point out that the P-curves need not have unique features that allow for more efficient computations during code breaking in order to be "weak" or "backdoored". Simply the fact that the curves are standardized may allow expedited code breaking. We saw this with POISON NUT/CORAL REEF (where specialized hardware (PIQ Blade), pre-computation work, and an otherwise fine small standardized set of primitives allowed for rapidly broken encryption).

25519 is great. But you can't use it in DNSSEC.

It is being worked on. https://datatracker.ietf.org/doc/draft-wouters-sury-dnsop-al...

Oh, yeah, standards.

I believe someone here said you said one shouldn't rely on DNSSEC anyway?

We're on a subthread about DNSSEC, not about curves.

Oops, sorry.

As someone who is an amateur at cryptography, are you being earnest or facetious about the terrifying nature of ECDSA?

Both ECDSA and the P- curves are terrifying. Not because NIST backdoored either of them, but because they're both comically easy to fuck up.

They are last-generation legacy elliptic curve operations. Cryptographers have moved on to significantly better, safer designs.

It's 2016 and the vanguard of cryptographic modernity in DNSSEC is P-curve ECDSA --- if you use it, you're taking a risk that some deployed resolvers won't understand your zones. The breaking-change new crypto in DNSSEC is already obsolete.

Reply on news.ycombinator.com