Hacker News Reader

Comment by corvettez0606 | Hacker News Reader

With these kind of changes I always wonder if they make the product more secure or less secure.

It's why I'm thankful it's both open source and highly scrutinized by the community, both volunteers, independent security researchers, and big companies like Google that deploy billions of instances of Linux (servers, google cloud, android, chromeOS, etc).

The backdoored elliptical curves were vetted too…

I've not been in the loop, what was this?

https://en.wikipedia.org/wiki/RSA_Security#NSA_Dual_EC_DRBG_...

https://en.wikipedia.org/wiki/Dual_EC_DRBG

Compromised approved (subsequently retracted) elliptic curve random number generator [1]

Potentially-compromised elliptic curves used for Diffie-Hellman-Merkle key agreement and digital signatures [2][3][4]

[1] https://en.wikipedia.org/wiki/Dual_EC_DRBG

[2] https://safecurves.cr.yp.to/rigid.html

[3] https://www.hyperelliptic.org/tanja/vortraege/20130531.pdf

[4] https://blog.cr.yp.to/20140323-ecdsa.html

Dual EC DRBG is the known backdoored curve. You have the links to the high level story in a sibling comment.

I would also like to add, however, that the possibility of a backdoor was patented by Scott Vanstone I think, and raised in NIST standardization process (and I suspect standardized under pressure from the NSA more than anything). Other negative facts that were raised include the fact that it sucks badly, i.e. compared to just about any other RNG, it performs very poorly. So the process isn't as bad as it looks.

DualEC was a backdoor, but not a very good one. People noticed the possibility and it sucks compared to literally anything else. The only people who used it appear to be customers of RSA Inc.

I would also like to add that Elliptic (not Elliptical, these are not the equations of ellipses) Curves, even the NIST ones, are not known to be backdoored and there's no evidence they contain any weaknesses at present. There are plenty of non-American cryptographers who are unlikely to keep any analysis a secret if they found such evidence, and I would say quite a few American ones who would also publish.

And we know about it. The backdoor methods have been generalized and now researchers can check for that too.

For example bitcoin's elliptic curve secp256k1 was choosen because its constants were chosen in a predictable way and that reduces the possibility of a backdoor.

As Jason mentions, the most important contribution here is to make the code more readable and improve documentation.

But there are also some fairly unambiguous improvements - switching from SHA1 to BLAKE2 for extracting the random bytes for example.

Yes, I think there's some points we can generalize for all software there:

- Readability counts. If you can't read the code, who could test or improve it?

- Documentation needs to be cared for near the code, only then you have a chance it's not outdated

- It's possible to improve correctness and efficiency at the same time (if your code is understandable)

- Use the literature available

- Code once holding high standards will need to be checked constantly too so it doesn't rot.

With this and Wireguard Jason is hitting it out of the park. I wonder what's next.

In this case, more.

Reply on news.ycombinator.com