A riddle wrapped in a curve

http://blog.cryptographyengineering.com/2015/10/a-riddle-wrapped-in-curve.html

by wbond • 11 years ago

159 54 11 years ago

blog.cryptographyengineering.com

rockdoe5• 11 years ago

So the conclusion is that the most reasonable theory is that the NSA has made an advance on ECDLP making them believe they can get faster Pollard-Rho (potentially n^1/3) or that they found signs the curve structures are weak?

Pretty mind blowing.

tptacek5• 11 years ago

Not really. The paper goes into much more detail, and the most reasonable theory in the paper is that if you believe there are going to be practical quantum computers in 15-20 years, there are lots of agencies and businesses that have secrets that need more than 15-20 years of protection, so the switch to PQ crypto needs to happen sooner than later.

rockdoe5• 11 years ago

Hmm, that's not the vibe I get.

The blog indeed doesn't say it is necessarily the most reasonable theory, but goes in depth towards only one:

"I’d like to focus on what I think is the most intriguing hypotheses in the paper. Namely, that the NSA isn’t worried about quantum computers at all, but rather, that they’ve made a major advance in classical cryptanalysis of the elliptic curve discrete logarithm problem — and panic is the result."

As for the viability of practical quantum computers, the original paper says:

"If practical quantum computers are at least 15 years away, and possibly much longer, and if it will take many years to develop and test the proposed PQC systems and reach a consensus on standards, then a long time remains when people will be relying on ECC. But the NSA’s PQC announcement makes it clear that improved ECC standards (for example, an updated list of recommended curves) are not on the Agency’s agenda."

"However, for such users the NSA statement recommends using an additional layer of AES to provide quantum resistance, without waiting for quantum-safe public-key standards. In any case, the statement is directed at the general public and obviously is going to have a big impact in the private sector. If the NSA had wanted to give advice that was intended only for high-security government users, they would have done so."

The latter paragraph seems to contradict your conclusion directly. I read the paper as saying that in the case you describe, it would have been reasonable for the NSA to continue ECC work while fleshing out post QC alternatives.

But this did not happen.

jfindley• 11 years ago

This is deeply alarming, and (at least to me) very unexpected.

For the minute I'm assuming that we shouldn't be changing anything right now - it seems a bit drastic to immediately abandon ECC right now based on this - but this is only my assumption. I'm waiting hopefully for more comments on this from the crypto community.

charrisku4• 11 years ago

As a mathematician (though not a cryptographer), I have a great deal of difficulty trusting cryptographic protocols which have a mathematical basis. Whether they are based on factoring, elliptic curves, or any other mathematical concept, they always "smelled" sketchy to me for the very simple reason that they are easy to formulate in terms of mathematical ideas, hence naturally lend themselves to the thought process of an algebraist or a number theorist. In short, these problems look like precisely the sort of questions a mathematical genius would find tractable. Without any solid proof that they are actually computationally hard to break, it seems like they are inherently dangerous to rely upon because they look like fair game to the next Ramanujan.

I'll also go out on a limb here and also say that I think the technology community has a bias towards thinking something like "math == hard" is true, so gives added weight towards using these same protocols. I know many people here have deep knowledge of both cryptography and software development, so I'd be very interested to hear other people's thoughts on these issues. Can anyone speak about options to math-based public key algorithms, or ways to inject some skepticism into the tech community about these algorithms, so perhaps alternatives can start being implemented? A public key algorithm which doesn't lend itself easily to algebraic analysis would feel much safer to me.

tveita• 11 years ago

In practice, relying on a clearly defined mathematical problem that is thought to be hard to solve has worked out a lot better than the common alternative of throwing a bunch of random shit together and hoping the result is too complex for anyone to understand.

For asymmetric cryptography there is no alternative not based on math. Even snake oil cryptography mostly deals in symmetric crypto like "unbreakable" ciphers and hashes, because you can't make a working asymmetric encryption scheme by mashing together whatever operations your schizophrenia tells you to.

rockdoe5• 11 years ago

Pretty much all of crypto is based on and analyzed by math (at the very least computing and complexity theory), so I'm not clear at all what you're saying here.

People prefer algorithms with a clear mathematical basis because they're easier to analyze, so the flaws surface easier and it's clearer what breakthroughs would break them.

Cryptographers have been looking for algorithms that are NP-hard for example, because having a "breakthrough" in them having to require P=NP is a large hurdle. But it's not the end of the story, because it turns out that a problem being NP-hard doesn't mean it isn't easy to crack (worst case vs actual case).

Your comment reads a bit as saying "we shouldn't use maths to compute things". But maths is what computers do...

charrisku4• 11 years ago

I was mainly curious if any asymmetric algorithms exist which are not easily analyzed by algebraists, et al. According to the comment by tveita, this does not appear likely, and I am sorry to hear it. I don't discount what you say about mathematical algorithms being easier to analyze, so flaws are shallower. However, I have seen smart people do quite amazing things with mathematics in my life. People who spend years studying algebra or number theory learn so many patterns that the good ones can pull unbelievably clever arguments seemingly out of pure intuition. That is somewhat disconcerting to me because something like RSA or ECC is precisely the sort of problem those people can apply that intuition and pattern recognition towards. I obviously don't know of an asymmetric algorithm which is analogous, but something like AES is a nightmare to analyze algebraicly (it really does have that "jumble of shit" look to it when written out as an operator). That seems to me to offer some small resistance to the math genius with the spooky intuition. My main point was how dangerous a smart person can be with a problem that his/her brain is geared for, so I was curious if any algorithms existed which are not easy for a mathematician to attack.

JadeNB• 11 years ago

On what should they be based, if not a sound foundation that lends itself to rigorously proveable statements (I carefully say only proveable, not proven) and the well developed intuition of a community of experts? To say that, because mathematicians understand and can think about something, they will be able to solve it, seems to be denying the existence of long- (and still-) unsolved elementary problems.

syntheticnature• 11 years ago

The Discordians promulgated a code that might be a bit more mathematically resistant. It involves this series of steps:

  CONVERSION:
  A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
  1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

  STEP 1. Write out the message (HAIL ERIS) and put all the vowels at the end (HLRSAIEI)

  STEP 2. Reverse order (IEIASRLH)

  STEP 3. Convert to numbers (9-5-9-1-19-18-12-8)

  STEP 4. Put into numerical order (1-5-8-9-9-12-18-19)

  STEP 5. Convert back to letters (AEHIILRS)

They assert 100% unbreakability, which isn't true, but on a sufficiently long message one's anagram checker might give out, and then there is the task of ordering the words so generated...

Mind you, decryption by the intended recipient is equally complex.

philh• 11 years ago

Not 100% unbreakable in general, but I think it does pretty well in the real world. There are plenty of messages that Eve simply can't decrypt with complete confidence. For example, she can't tell ATTACK WILL AT DAWN from ATTACK DAWN AT WILL. She'd have to resort to priors to guess which of those was intended.

wolfgke3• 11 years ago

This algorithm can be simplified - step 2 can be skipped.

rpglover64• 11 years ago

Are you happier with the state of symmetric crypto, which, despite relying on conjectures (like the existence of pseudo-random functions) tends not to rely on _algebraic_ ones?

Personally, I don't have particular worries about the hardness assumptions of asymmetric crypto, and I think of them a bit like I think of bitcoin (hear me out). Yes, it is certain that eventually someone will solve the discrete log problem for any given algebraic structure (either by rendering all crypto that relies on it broken, or (less likely) proving it fundamentally secure), but for now, we know that this is hard (since it has been open for a while), and we're also incentivizing people to make mathematical discoveries.

I'd also claim that the "crypto community" (at least the academic side of it) and the "technology community" are not the same, and (at least to me) often feel opposed. Cryptologists write papers filled to the brim with dense and precise mathematical assumptions and reductions; technologists skim the papers, ignore the assumptions, and implement half-assed, unaudited versions of the systems in question and claim them secure (pardon my cynicism).

As to what the community thinks about mathematical public key crypto, they hail it as the greatest innovation since sliced bread and the herald of modern cryptography. Prior to modernity, cryptography was very ad-hoc and depended on what the author's intuitions; modernity introduced precise definitions of what it meant for a system to be secure and raised the bar. It also relies heavily on the concept of a hardness reduction, i.e. a proof that breaking a cryptogrpahic primitive is at least as hard as solving a yet-unsolved math problem.

Specifically about algebraic problems, I have a (low confidence) intuition that they are unavoidable in public-key crypto precisely because of the need for an algebraic structure relating the public and private keys. With this in mind, I'd rather have algorithms which rely on known hard to solve problems (demonstrated hard by having years of mathematical effort poured into them with minimal result) to those which rely on problems no one has ever bothered to look at.

A final question: you are unhappy with public key crypto that relies on algebra; would you be happier if it relied on some other branch of mathematics? Analysis? Topology (okay, so that's still algebra)? Complexity theory (a secure cryptosystem that relied only on P!=NP would be a holy grail for several reasons, but I don't know of any attempts to find one)? Would you feel safe using a cryptosystem that was secure if and only if the Riemann Hypothesis were true? If the RH were false? The Collatz Conjecture?

vox_mollis3• 11 years ago

cperciva vindicated?

edit: For context, Colin has maintained a conservative position regarding ECC for quite some time now.

tptacek5• 11 years ago

No. The crypto Colin advocates for also falls to QC.

sdevlin4• 11 years ago

The post talks about hypothetical improvements in non-QC approaches to the ECDLP.

vox_mollis3• 11 years ago

The article discusses the hypothesis that the NSA has broken ECC classically, and is lying to us.

But conspiracy theories aside, does 3072 bit RSA fall along with 256 bit ECC with the same quantum difficulty? Don't you have to have coherence of substantially more qubits in the former case?

paulmd3• 11 years ago

One possibility I didn't see discussed - the NIST curves are indeed kleptographically backdoored, and someone has managed to steal the key. That's always worried me about backdoored crypto - as advantageous as such a key would be for the NSA, it would be absolutely catastrophic for an adversary to get it. And if you are using it, a possibility of it being stolen inherently exists.

The problem with this theory is that in the event of compromise you'd expect the NSA to deprecate all of the curves, and not just P-256. It is also possible that this backdoor is not a magic bullet, and it merely makes an attack computationally feasible instead of decrypting it outright.

It does smell a lot more like there's been an advance in analysis, whether classical or quantum.

rockdoe5• 11 years ago

you'd expect the NSA to deprecate all of the curves, and not just P-256

You could argue that that is indeed what the announcement was doing. It was unrelated to P-256 being dropped.

(P-256 being dropped does point to the whole "it's not as hard as we thought it was" theory)

api3• 11 years ago

Maybe they backdoored P-256 and they think the backdoor may have leaked. That would inspire panic, especially since quite a few financial networks and military systems are protected by it.

blincoln• 11 years ago

What if the NIST curves were backdoored not by the NSA as a whole, but a rogue individual within the NSA, with the goal of making that backdoor available to a foreign power and/or the highest bidder?

It seems unlikely to me, because the NSA has so many brilliant people working for them, but it also seems like (at least superficially) it would explain just about every element of their reaction to this situation. They're used to being years or decades ahead of everyone else (e.g. differential cryptanalysis), and being caught off-guard would be an uncomfortable position for them.

</tinfoilhat>

tptacek5• 11 years ago

Matt Green's blog post discusses this possibility, and a plurality of the paper is dedicated to debunking it. To explain how, I'd have to restate stuff that's in the paper and already on this thread, so it'd be better if you just re-read it and then said what part of the arguments you found weren't persuasive.

paulmd3• 11 years ago

I read the Koblitz/Menenzes paper a second time, and again it doesn't really discuss the possibility of a kleptographic vulnerability. Yes, it discusses weak curves and the possibility of extant or (NSA-internal) speculation of a classical or quantum analysis technique at length - but those are fundamentally different from a security standpoint.

A kleptographic vulnerability (one which cannot be exploited without breaking a cryptographically strong problem) is entirely different from the plain "ECC believed strong but actually weak" situation. Once the latter vulnerability is known anyone could break it, but the former vulnerability is strong even if the theoretical basis for the backdoor is discovered.

It's the same fundamental difference between building a computational-theoretical hard algorithm and security-by-obscurity. The NSA is not dumb enough to bet on their trick remaining obscure - that stuff inevitably gets rediscovered, whether it's 5 years or 20 years. But it's easy to precompute E in the DUAL_EC_DRBN algorithm, while it's cryptographically strong to try and reverse it after the fact. Trapdoor functions work like one-way secure hashes (eg SHA) by design - easy in forwards, computationally infeasible (as a design goal) in reverse.

The patent on the concept of using that as a backdoor (although not in that exact phrasing) was filed in Jan 2005 [1] (years before the selection of the NIST curves in FIPS 186-3) and it's reasonable to believe the NSA would know of the existence of the backdoor since the filing at a minimum - if not before. It was published for public comment in 2007 [1] but didn't gain much publicity until granted in 2013(!) [2] after Snowden had gotten the disclosure train rolling.

If you have a specific page/paragraph reference you'd like to cite: please do, it's a topic I feel strongly about since the consequences of a compromised kleptographic backdoor could be rather extreme for anyone who uses those curves.

[1] http://www.google.com/patents/US20070189527

[2] https://www.google.com/patents/US8396213

zmanian• 11 years ago

It seems likely in a post Quantum computing world, we will have signatures and key exchange protocols at least good enough for software signing and secure communications.

But ECC has many ancillary properties for constructing homomorphic and zero knowledge proof based systems that don't have an post Quantum equivalent.

JoachimSchipper• 11 years ago

Lattice cryptography - although I wouldn't want to rely on it in 2015 - is quite flexible and does support such advanced systems. Also, homomorphic encryption and zero-knowledge proofs are almost entirely unused (and, due to the enormous overhead of FHE in particular, unusable) in practice. We'll deal.

api3• 11 years ago

Is NIST P-256 the same curve that Bitcoin uses?

https://en.bitcoin.it/wiki/Secp256k1

Edit: NO, but it's a relative and has a similar background.

Bitcoin is an interesting player here because it's in effect the largest bug bounty in history. If someone could crack it, they could slowly manipulate its price and bleed money out of the Bitcoin ecosystem to the tune of (conservatively) tens of millions of dollars before someone noticed that something more than a Bitcoin price crash was occurring. I'd assume that anyone sophisticated enough to actually break Bitcoin would also be sophisticated enough to use that break to do this by e.g. cracking wallets and slowly draining them or creating price-manipulating transactions.

So I'd expect any leakage of an ECC break that was actually practical to use in the real world (as opposed to an 'academic' break) to show up in the form of an enigmatic draining of the Bitcoin piggy bank.

lisper2• 11 years ago

they could slowly manipulate its price

How? The only way you can drive the price of bitcoin (relative to some other currency) is to buy or sell it for that currency. You can't manipulate the price simply by moving bitcoins around.

What you could do, of course, is drive the price down by making it known that BTC had been cracked. You could probably even do this so that it played out over a period of days before people were really convinced it was cracked and the whole ecosystem collapsed. But it's hard to see how anyone could profit off this. AFAIK there's no way to short bitcoin.

yuhong• 11 years ago

Still it is pretty interesting that NIST P-224 has weaknesses that the other ones don't. I wonder why?

lisper2• 11 years ago

I just read the full original paper, and this seems like the most likely explanation to me:

"[T]he main considerations might not have been technical at all, but rather Agency-specific — that is, related to the difficult situation the NSA was in following the Snowden leaks. The loss of trust and credibility from the scandal about Dual EC DRBG was so great that NSA might have anticipated that anything further it said about ECC standards would be mistrusted. The NSA might have felt that the quickest way to recover from the blow to its reputation would be to get a “clean slate” by abandoning its former role as promoters of ECC and moving ahead with the transition to post-quantum cryptography much earlier than it otherwise would have."

I spent >10 years working for the government, and this scenario is entirely consistent with my experience there.

A riddle wrapped in a curve

Related Stories