<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On Sep 7, 2013, at 6:30 PM, "James A. Donald" <<a href="mailto:jamesd@echeque.com">jamesd@echeque.com</a>> wrote:<br><br></div><blockquote type="cite"><div><span>On 2013-09-08 4:36 AM, Ray Dillinger wrote:</span><br><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>But are the standard ECC curves really secure? Schneier sounds like he's got</span><br></blockquote><blockquote type="cite"><span>some innovative math in his next paper if he thinks he can show that they</span><br></blockquote><blockquote type="cite"><span>aren't.</span><br></blockquote><span></span><br><span>Schneier cannot show that they are trapdoored, because he does not know where the magic numbers come from.</span><br><span></span><br><span>To know if trapdoored, have to know where those magic numbers come from.</span><br></div></blockquote><br><div>That will not work....</div><div><br></div><div>When the community questioned the source of the DES S boxes, Don Coppersmith and Walt Tuchman if IBM at the time openly discussed the how they were generated and it still did not quell the suspicion. I bet there are many that still believe DES has an yet to be determined backdoor. </div><div><br></div><div>There is no way to prove the absence of a back door, only to prove or argue that a backdoor exists with (at least) a demonstration or evidence one is being used. Was there any hint in the purloined material to this point? There seems to be the opposite. TLS using ECC is not common on the Internet (See "Ron was wrong, Whit is right"). If there is a vulnerability in ECC it is not the source of today's consternation. (ECC is common on ssh, see "<span style="font-family: NimbusRomNo9L; font-size: 14pt; ">Mining Your Ps and Qs: Detection of
Widespread Weak Keys in Network Devices</span>")</div><div><br></div><div>I will be looking forward to Bruce's next paper.</div><div><br></div></body></html>