Tanja Lange

Here is what Bernstein has to say about RSA https://www.hyperelliptic.org/tanja/vortraege/facthacks-29C3.pdf See the conclusion slides. In short, RSA is secure if primes are large and random. It’s worth mentioning, Bernstein is the author of a competing algorithm. There are hundreds of scientific talks and articles about RSA by renowned cryptographers.

> if you can't trust a browser's P-curves, you can't trust their GCM either. Is that true though? I mean, from what I've read GCM seems much easier to implement than a full ECDH. I mean, have a look at some of the things published by Bernstein and Lange, https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf They do certainly have a horse in the race, but it's still interesting. They and others have also raised concerns about potential backdoors in the NIST curves, which is, while still unproven another reason why one might avoid them. They failed to do things as basic in the cryptographic community as using "nothing up my sleeve" numbers, it just seems sketchy at best to me. The random curves at least. The others are probably still just fine but the random ones are the most popular in TLS.

I actually agree with most of this. The issue with the NIST P- curves is that there's no good reason to trust them. And, for what it's worth, being ahead of academia on pure math isn't science fiction; NSA employs a lot of mathematicians. But the notion of a backdoor in the NIST curves is totally speculative. Here's what I was trying to capture: http://www.hyperelliptic.org/tanja/vortraege/20130531.pdf Despite its very weird submission as a story to HN, what you'd been reading was just a very long HN comment; I wrote it in a single draft and in the style I would use when writing a comment.

Sage is wonderful. It has a huge number of uses but I mostly use it for cryptography. Sage has the best (certainly open source) support I know of for a myriad of things like group theory and elliptic curves. Here's a short example for how easy it is to play around with a tiny elliptic curve: sage: p = 19; p.is_prime() True sage: K = GF(p); K Finite Field of size 19 sage: E = EllipticCurve(K, [5, 9]); E Elliptic Curve defined by y^2 = x^3 + 5*x + 9 over Finite Field of size 19 sage: E.count_points(), E.order(), E.gens() (19, 19, [(4 : 6 : 1)]) There are far too many things to name that sage can do, but the CLI has a great autocomplete. Here's an example: let's say you have ECDH with point compression, and you specify only an x coordinate. Point compression limits the effectiveness of invalid curve attacks, where an attacker gives you a maliciously picked Diffie-Hellman value that isn't actually on the curve you're supposed to be on. However, if the x coordinate doesn't map to a point on the curve, it's necessarily on its "nontrivial quadratic twist". Sage makes this easy to play with because sage makes pretty much everything easy to play with: sage: E.lift_x(6, all=True) [] sage: E.quadratic_twist() Elliptic Curve defined by y^2 = x^3 + 6*x + 13 over Finite Field of size 19 sage: E.quadratic_twist().lift_x(6, all=True) [(6 : 6 : 1), (6 : 13 : 1)] If you want to do a full-on invalid curve attack, the easiest way to do that…

'tptacek commented 17 days ago about EC crypto (https://news.ycombinator.com/item?id=6608163): You should never, ever, never, nevern, nervenvarn build your own production ECC code. ECC is particularly tricky to get right. But if you want to play with the concepts, a great place to start is the Explicit Formulas Database at http://www.hyperelliptic.org/EFD/ ; the fast routines for point multiplication are mercifully complicated, so copying them from the EFD is a fine way to start, instead of working them out from first principles. He went on to say that only Adam Langley or Daniel Bernstein should be implementing ECC. Probably because there are so many ways to slip up; few others would have the experience necessary to avoid all the pitfalls. 'theboss agreed: I've implemented ECC and you are 100% correct. Nobody should implement ECC unless you really really know what you're doing. Mapping points to the curve, multiplying points, point addition, there is too much math stuff to mess up on. Just don't do it. If you read one thing tptacek says, read the last paragraph.

https://hyperelliptic.org/tanja/vortraege/20140506.pdf contains excerpts from the original article. Also searching for “Project Bullrun” brings up various articles on the Dual EC DRBG attacks.

For a more humorous tale of recovering a private key after a chunk of it was damaged (in this case, replaced by the string "FUCK A DUCK"), see this hilarious CRYPTO 2012 rump session talk: https://crypto.2012.rump.cr.yp.to/87d4905b6d2fbc6ad2389debb73f7035.pdf There is also a video and a few more details here (starting at 47:38) in their longer CCC talk: https://youtu.be/v_X0gUzGWsA?t=2858 (Slides for that longer talk: https://www.hyperelliptic.org/tanja/vortraege/facthacks-29C3.pdf)

NIST P-256 (and ECDSA in general, to some extent) is widely suspected to have been subverted by NSA, as outlined in the first link in octoberfranklin's response, page 16 of [1], and [2]. [1] https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf [2] https://blog.cr.yp.to/20140323-ecdsa.html "I have a different view. I blame this attack on the ECDSA designers [https://www.nsa.gov/]."

If you want a good (IMHO) example of how Lisp can be made to "meet the problem" so to speak, take a look at this: http://www.flownet.com/ron/lisp/djbec.lisp and take a look at the functions xpt-add and xpt-double. The details don't really matter. What matters is that what is going on here is a whole bunch of modular arithmetic. The details are described here: http://www.hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html Notice how the Lisp code is virtually cut-and-pasted from that page, despite the fact that it's not Lispy syntax, and the mathematical operators are NOT traditional addition, multiplication, etc. These are operations on modular integers and elliptic curve points. And yet the code looks just like the source material from which it was derived. To make all this magic happen required less than 500 LOC.

There's also this list of MOOCs https://www.reddit.com/r/learnprogramming/comments/4rimxf/heres_a_list… What I do is find a university and look at their course public page where often in the calendar/schedule you can find lecture notes, slides and sometimes the lectures. If you find the lectures immediately grab them with some browser plugin to archive because they tend to disappear. TU/e in NL has a lot of open english taught courses I've found, like this one with lecture videos http://www.hyperelliptic.org/tanja/teaching/crypto16/

Tanja Lange [0] did a talk om post-quantumcrypto @ 32c3 https://media.ccc.de/v/32c3-7210-pqchacks. Last week she organised a 1 day workshop in Utrecht [1] [0] http://www.hyperelliptic.org/tanja/ [1] https://pqcrypto.eu.org/mini.html

He is listed by Tanja Lange as one of her PhD students: http://www.hyperelliptic.org/tanja/

I have seen this at the (shameless) Spring textbooks table at CRYPTO, and it seems to be useful as a reference (the few times I have checked it out of the library): http://www.hyperelliptic.org/HEHCC/ It is a bit pricey though.

It relies on there being common factors somewhere between any keys in a big set. That should only happen through a very small chance or through random-generation weaknesses. The point is that it's easy to spot it if there are keys with those weaknesses. This CCC talk is related to this: http://events.ccc.de/congress/2012/Fahrplan/events/5275.en.html Since ssh keys are user-submitted, we will have diversity and a chance of some subset of keys which weren't generated safely. EDITED TO ADD: Bad CCC site, it doesn't link to the FactHacks slides: http://www.hyperelliptic.org/tanja/vortraege/facthacks-29C3.pdf

https://twitter.com/matthew_d_green/status/253247571668115456 :) And there is Keccup by the same authors: http://www.hyperelliptic.org/DIAC/slides/PermutationDIAC2012.pdf

> "However, they gave no evidence of a back door, and in the two decades since that time no one has found a way that a back door could be inserted in DSA (or ECDSA)." ElGamal/DSA is fragile and difficult to implement securely in a way that doesn't reveal secret k. ECC (and somewhat particularly NIST curves[1]) is also very difficult to implement securely from side channel attacks[2]. Consideration of "backdoors" should be broader than just mathematical equations on paper. "backdoors" could also include deliberate choice of algorithm or parameters that are fragile and difficult to implement in a secure way to minimise risk of side channel leakage of secrets. This is especially important in a whole variety of applications such as passports, payment cards and TPMs. [1] https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf#page=23 [2] Specifically, implementation of: https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication

It seems they are now bringing additional allegations[1] to other Wikileaks Associates _and_ people who gave talks at CCC between 2013-2015. Namely Jake Appelabaum who is currently (doing a PhD[1] with T. Lange & DJB). The US seems to have a hard-on also for members of the "Rosa-Luxembourg Stiftung" who insulted the empire by giving talks about their illegal drone wars[2][3] and shed light on how German engineers were working as sub-contractors for US airbases in Germany (as data scientist and software engineers). EU countries, especially Germany, France (I have less hope for Eastern-EU or Sweden) need to stop extraditions to US of A stat. Also these US terrorists dressed up as politicians need to be sanctioned (I understand this is a pipe dream) and prosecuted at the ICC (another pipe dream). --- [0] (in German) https://www.heise.de/tp/features/USA-spaehten-fuer-Assange-Anklage-Ver… [1] https://hyperelliptic.org/tanja/students.html [2] https://media.ccc.de/v/32c3-7259-graphs_drones_phones [3] https://www.rosalux.de/dokumentation/id/14090/drone-warfare-origins-co…