How to manipulate curve standards: A white paper for the black hat

Daniel J. Bernstein; Tung Chou; Chitchanok Chuengsatiansup; Andreas Hülsing; Eran Lambooij; Tanja Lange; Ruben Niederhagen; Christine Van Vredendaal

doi:10.1007/978-3-319-27152-1_6

How to manipulate curve standards: A white paper for the black hat

Daniel J. Bernstein, Tung Chou, Chitchanok Chuengsatiansup, Andreas Hülsing, Eran Lambooij, Tanja Lange, Ruben Niederhagen, Christine Van Vredendaal

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

This paper analyzes the cost of breaking ECC under the following assumptions: (1) ECC is using a standardized elliptic curve that was actually chosen by an attacker; (2) the attacker is aware of a vulnerability in some curves that are not publicly known to be vulnerable. This cost includes the cost of exploiting the vulnerability, but also the initial cost of computing a curve suitable for sabotaging the standard. This initial cost depends heavily upon the acceptability criteria used by the public to decide whether to allow a curve as a standard, and (in most cases) also upon the chance of a curve being vulnerable. This paper shows the importance of accurately modeling the actual acceptability criteria: i.e., figuring out what the public can be fooled into accepting. For example, this paper shows that plausible models of the “Brainpool acceptability criteria” allow the attacker to target a onein- a-million vulnerability and that plausible models of the “Microsoft NUMS criteria” allow the attacker to target a one-in-a-hundred-thousand vulnerability.

Original language	English
Title of host publication	Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings
Editors	Liqun Chen, Shin’ichiro Matsuo
Publisher	Springer Verlag
Pages	109-139
Number of pages	31
ISBN (Print)	9783319271514
DOIs	https://doi.org/10.1007/978-3-319-27152-1_6
State	Published - 2015
Event	2nd International Conference on Security Standardisation Research, SSR 2015 - Tokyo, Japan Duration: 15 Dec 2015 → 16 Dec 2015

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	9497
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	2nd International Conference on Security Standardisation Research, SSR 2015
Country/Territory	Japan
City	Tokyo
Period	15/12/15 → 16/12/15

Bibliographical note

Publisher Copyright:
© Springer International Publishing Switzerland 2015.

Keywords

ANSI X9
Brainpool
Elliptic-curve cryptography
Microsoft NUMS
Minimal curves
NIST
Nothing-up-mysleeve numbers
SECG
Verifiably pseudorandom curves
Verifiably random curves

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-319-27152-1_6

Cite this

Bernstein, D. J., Chou, T., Chuengsatiansup, C., Hülsing, A., Lambooij, E., Lange, T., Niederhagen, R., & Van Vredendaal, C. (2015). How to manipulate curve standards: A white paper for the black hat. In L. Chen, & S. Matsuo (Eds.), Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings (pp. 109-139). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9497). Springer Verlag. https://doi.org/10.1007/978-3-319-27152-1_6

Bernstein, Daniel J. ; Chou, Tung ; Chuengsatiansup, Chitchanok et al. / How to manipulate curve standards : A white paper for the black hat. Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings. editor / Liqun Chen ; Shin’ichiro Matsuo. Springer Verlag, 2015. pp. 109-139 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{d85e162e8d3b4878970d1bd46c4e8148,

title = "How to manipulate curve standards: A white paper for the black hat",

abstract = "This paper analyzes the cost of breaking ECC under the following assumptions: (1) ECC is using a standardized elliptic curve that was actually chosen by an attacker; (2) the attacker is aware of a vulnerability in some curves that are not publicly known to be vulnerable. This cost includes the cost of exploiting the vulnerability, but also the initial cost of computing a curve suitable for sabotaging the standard. This initial cost depends heavily upon the acceptability criteria used by the public to decide whether to allow a curve as a standard, and (in most cases) also upon the chance of a curve being vulnerable. This paper shows the importance of accurately modeling the actual acceptability criteria: i.e., figuring out what the public can be fooled into accepting. For example, this paper shows that plausible models of the “Brainpool acceptability criteria” allow the attacker to target a onein- a-million vulnerability and that plausible models of the “Microsoft NUMS criteria” allow the attacker to target a one-in-a-hundred-thousand vulnerability.",

keywords = "ANSI X9, Brainpool, Elliptic-curve cryptography, Microsoft NUMS, Minimal curves, NIST, Nothing-up-mysleeve numbers, SECG, Verifiably pseudorandom curves, Verifiably random curves",

author = "Bernstein, {Daniel J.} and Tung Chou and Chitchanok Chuengsatiansup and Andreas H{\"u}lsing and Eran Lambooij and Tanja Lange and Ruben Niederhagen and {Van Vredendaal}, Christine",

note = "Publisher Copyright: {\textcopyright} Springer International Publishing Switzerland 2015.; 2nd International Conference on Security Standardisation Research, SSR 2015 ; Conference date: 15-12-2015 Through 16-12-2015",

year = "2015",

doi = "10.1007/978-3-319-27152-1_6",

language = "English",

isbn = "9783319271514",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "109--139",

editor = "Liqun Chen and Shin{\textquoteright}ichiro Matsuo",

booktitle = "Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings",

address = "Germany",

}

Bernstein, DJ, Chou, T, Chuengsatiansup, C, Hülsing, A, Lambooij, E, Lange, T, Niederhagen, R & Van Vredendaal, C 2015, How to manipulate curve standards: A white paper for the black hat. in L Chen & S Matsuo (eds), Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 9497, Springer Verlag, pp. 109-139, 2nd International Conference on Security Standardisation Research, SSR 2015, Tokyo, Japan, 15/12/15. https://doi.org/10.1007/978-3-319-27152-1_6

How to manipulate curve standards: A white paper for the black hat. / Bernstein, Daniel J.; Chou, Tung; Chuengsatiansup, Chitchanok et al.
Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings. ed. / Liqun Chen; Shin’ichiro Matsuo. Springer Verlag, 2015. p. 109-139 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 9497).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - How to manipulate curve standards

T2 - 2nd International Conference on Security Standardisation Research, SSR 2015

AU - Bernstein, Daniel J.

AU - Chou, Tung

AU - Chuengsatiansup, Chitchanok

AU - Hülsing, Andreas

AU - Lambooij, Eran

AU - Lange, Tanja

AU - Niederhagen, Ruben

AU - Van Vredendaal, Christine

N1 - Publisher Copyright: © Springer International Publishing Switzerland 2015.

PY - 2015

Y1 - 2015

N2 - This paper analyzes the cost of breaking ECC under the following assumptions: (1) ECC is using a standardized elliptic curve that was actually chosen by an attacker; (2) the attacker is aware of a vulnerability in some curves that are not publicly known to be vulnerable. This cost includes the cost of exploiting the vulnerability, but also the initial cost of computing a curve suitable for sabotaging the standard. This initial cost depends heavily upon the acceptability criteria used by the public to decide whether to allow a curve as a standard, and (in most cases) also upon the chance of a curve being vulnerable. This paper shows the importance of accurately modeling the actual acceptability criteria: i.e., figuring out what the public can be fooled into accepting. For example, this paper shows that plausible models of the “Brainpool acceptability criteria” allow the attacker to target a onein- a-million vulnerability and that plausible models of the “Microsoft NUMS criteria” allow the attacker to target a one-in-a-hundred-thousand vulnerability.

AB - This paper analyzes the cost of breaking ECC under the following assumptions: (1) ECC is using a standardized elliptic curve that was actually chosen by an attacker; (2) the attacker is aware of a vulnerability in some curves that are not publicly known to be vulnerable. This cost includes the cost of exploiting the vulnerability, but also the initial cost of computing a curve suitable for sabotaging the standard. This initial cost depends heavily upon the acceptability criteria used by the public to decide whether to allow a curve as a standard, and (in most cases) also upon the chance of a curve being vulnerable. This paper shows the importance of accurately modeling the actual acceptability criteria: i.e., figuring out what the public can be fooled into accepting. For example, this paper shows that plausible models of the “Brainpool acceptability criteria” allow the attacker to target a onein- a-million vulnerability and that plausible models of the “Microsoft NUMS criteria” allow the attacker to target a one-in-a-hundred-thousand vulnerability.

KW - ANSI X9

KW - Brainpool

KW - Elliptic-curve cryptography

KW - Microsoft NUMS

KW - Minimal curves

KW - NIST

KW - Nothing-up-mysleeve numbers

KW - SECG

KW - Verifiably pseudorandom curves

KW - Verifiably random curves

UR - http://www.scopus.com/inward/record.url?scp=84952768133&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-27152-1_6

DO - 10.1007/978-3-319-27152-1_6

M3 - Conference contribution

AN - SCOPUS:84952768133

SN - 9783319271514

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 109

EP - 139

BT - Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings

A2 - Chen, Liqun

A2 - Matsuo, Shin’ichiro

PB - Springer Verlag

Y2 - 15 December 2015 through 16 December 2015

ER -

Bernstein DJ, Chou T, Chuengsatiansup C, Hülsing A, Lambooij E, Lange T et al. How to manipulate curve standards: A white paper for the black hat. In Chen L, Matsuo S, editors, Security Standardisation Research - 2nd International Conference, SSR 2015, Proceedings. Springer Verlag. 2015. p. 109-139. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-27152-1_6

How to manipulate curve standards: A white paper for the black hat

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this