Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> if you can't trust a browser's P-curves, you can't trust their GCM either.

Is that true though? I mean, from what I've read GCM seems much easier to implement than a full ECDH. I mean, have a look at some of the things published by Bernstein and Lange, https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf

They do certainly have a horse in the race, but it's still interesting. They and others have also raised concerns about potential backdoors in the NIST curves, which is, while still unproven another reason why one might avoid them. They failed to do things as basic in the cryptographic community as using "nothing up my sleeve" numbers, it just seems sketchy at best to me. The random curves at least. The others are probably still just fine but the random ones are the most popular in TLS.



GCM is extremely tricky to implement safely.

ECDH itself is very easy to implement; it's just DH (which is probably the simplest algorithm in cryptography), but in a different group.

ECC (the group) is hard to implement safely. The NIST P-curves are tricky to implement relative to Curve25519.

But there's also a lot more study of how to safely implement the NIST P- curves than there is for how to make a constant-time GCM.

I don't know. They seem like comparably difficult tasks.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: