Non-uniform Concrete security: an example cracks in the concrete: - PowerPoint PPT Presentation

Non-uniform Concrete security: an example cracks in the concrete: What is the best NIST P-256 the power of free precomputation discrete-log attack algorithm? D. J. Bernstein ECDL input: P-256 points P❀ ◗ , University of Illinois at Chicago & where P is a standard generator. Technische Universiteit Eindhoven ECDL output: log P ◗ . Tanja Lange Standard definition of “best”: Technische Universiteit Eindhoven minimize “time”. Full 53-page paper, including progress towards formalizing collision resistance: eprint.iacr.org/2012/318

Non-uniform Concrete security: an example cracks in the concrete: What is the best NIST P-256 the power of free precomputation discrete-log attack algorithm? D. J. Bernstein ECDL input: P-256 points P❀ ◗ , University of Illinois at Chicago & where P is a standard generator. Technische Universiteit Eindhoven ECDL output: log P ◗ . Tanja Lange Standard definition of “best”: Technische Universiteit Eindhoven minimize “time”. Full 53-page paper, More generally, allow attacks with including progress towards ❁ 100% success probability; formalizing collision resistance: analyze tradeoffs between eprint.iacr.org/2012/318 “time” and success probability. This talk focuses on high prob.

Non-uniform Concrete security: an example P-256 discrete- ✮ in the concrete: total TLS-ECDHE-P-256 What is the best NIST P-256 wer of free precomputation Should TLS discrete-log attack algorithm? Bernstein ECDL input: P-256 points P❀ ◗ , University of Illinois at Chicago & where P is a standard generator. echnische Universiteit Eindhoven ECDL output: log P ◗ . Lange Standard definition of “best”: echnische Universiteit Eindhoven minimize “time”. 53-page paper, More generally, allow attacks with including progress towards ❁ 100% success probability; rmalizing collision resistance: analyze tradeoffs between eprint.iacr.org/2012/318 “time” and success probability. This talk focuses on high prob.

Concrete security: an example P-256 discrete-log ✮ concrete: total TLS-ECDHE-P-256 What is the best NIST P-256 free precomputation Should TLS users discrete-log attack algorithm? ECDL input: P-256 points P❀ ◗ , Illinois at Chicago & where P is a standard generator. Universiteit Eindhoven ECDL output: log P ◗ . Standard definition of “best”: Universiteit Eindhoven minimize “time”. er, More generally, allow attacks with rogress towards ❁ 100% success probability; ion resistance: analyze tradeoffs between eprint.iacr.org/2012/318 “time” and success probability. This talk focuses on high prob.

Concrete security: an example P-256 discrete-log attack ✮ total TLS-ECDHE-P-256 break! What is the best NIST P-256 recomputation Should TLS users worry? discrete-log attack algorithm? ECDL input: P-256 points P❀ ◗ , Chicago & where P is a standard generator. Eindhoven ECDL output: log P ◗ . Standard definition of “best”: Eindhoven minimize “time”. More generally, allow attacks with ❁ 100% success probability; resistance: analyze tradeoffs between eprint.iacr.org/2012/318 “time” and success probability. This talk focuses on high prob.

Concrete security: an example P-256 discrete-log attack ✮ total TLS-ECDHE-P-256 break! What is the best NIST P-256 Should TLS users worry? discrete-log attack algorithm? ECDL input: P-256 points P❀ ◗ , where P is a standard generator. ECDL output: log P ◗ . Standard definition of “best”: minimize “time”. More generally, allow attacks with ❁ 100% success probability; analyze tradeoffs between “time” and success probability. This talk focuses on high prob.

Concrete security: an example P-256 discrete-log attack ✮ total TLS-ECDHE-P-256 break! What is the best NIST P-256 Should TLS users worry? discrete-log attack algorithm? No. Many researchers have ECDL input: P-256 points P❀ ◗ , tried and failed to find good where P is a standard generator. P-256 discrete-log attacks. ECDL output: log P ◗ . Standard definition of “best”: minimize “time”. More generally, allow attacks with ❁ 100% success probability; analyze tradeoffs between “time” and success probability. This talk focuses on high prob.

Concrete security: an example P-256 discrete-log attack ✮ total TLS-ECDHE-P-256 break! What is the best NIST P-256 Should TLS users worry? discrete-log attack algorithm? No. Many researchers have ECDL input: P-256 points P❀ ◗ , tried and failed to find good where P is a standard generator. P-256 discrete-log attacks. ECDL output: log P ◗ . Standard conjecture: Standard definition of “best”: For each ♣ ✷ [0 ❀ 1], minimize “time”. each P-256 ECDL algorithm with success probability ✕ ♣ More generally, allow attacks with takes “time” ✕ 2 128 ♣ 1 ❂ 2 . ❁ 100% success probability; analyze tradeoffs between Similar conjectures for AES-128, “time” and success probability. RSA-3072, etc.: see, e.g., This talk focuses on high prob. 2005 Bellare–Rogaway.

Concrete security: an example P-256 discrete-log attack ✮ Concrete total TLS-ECDHE-P-256 break! is the best NIST P-256 Another Should TLS users worry? discrete-log attack algorithm? Each TLS-ECDHE-P-256 No. Many researchers have with succes ✕ ♣ input: P-256 points P❀ ◗ , ♣ ❂ tried and failed to find good takes “time” ✕ P is a standard generator. P-256 discrete-log attacks. output: log P ◗ . Standard conjecture: Standard definition of “best”: For each ♣ ✷ [0 ❀ 1], minimize “time”. each P-256 ECDL algorithm with success probability ✕ ♣ generally, allow attacks with takes “time” ✕ 2 128 ♣ 1 ❂ 2 . ❁ success probability; analyze tradeoffs between Similar conjectures for AES-128, and success probability. RSA-3072, etc.: see, e.g., talk focuses on high prob. 2005 Bellare–Rogaway.

y: an example P-256 discrete-log attack ✮ Concrete reductions total TLS-ECDHE-P-256 break! est NIST P-256 Another conjecture: Should TLS users worry? attack algorithm? Each TLS-ECDHE-P-256 No. Many researchers have with success probabilit ✕ ♣ P-256 points P❀ ◗ , takes “time” ✕ 2 128 ♣ ❂ tried and failed to find good P standard generator. P-256 discrete-log attacks. log P ◗ . Standard conjecture: definition of “best”: For each ♣ ✷ [0 ❀ 1], ”. each P-256 ECDL algorithm with success probability ✕ ♣ allow attacks with takes “time” ✕ 2 128 ♣ 1 ❂ 2 . ❁ probability; tradeoffs between Similar conjectures for AES-128, success probability. RSA-3072, etc.: see, e.g., cuses on high prob. 2005 Bellare–Rogaway.

example P-256 discrete-log attack ✮ Concrete reductions total TLS-ECDHE-P-256 break! P-256 Another conjecture: Should TLS users worry? rithm? Each TLS-ECDHE-P-256 attack No. Many researchers have with success probability ✕ ♣ oints P❀ ◗ , takes “time” ✕ 2 128 ♣ 1 ❂ 2 . tried and failed to find good P generator. P-256 discrete-log attacks. P ◗ Standard conjecture: est”: For each ♣ ✷ [0 ❀ 1], each P-256 ECDL algorithm with success probability ✕ ♣ attacks with takes “time” ✕ 2 128 ♣ 1 ❂ 2 . ❁ y; Similar conjectures for AES-128, robability. RSA-3072, etc.: see, e.g., prob. 2005 Bellare–Rogaway.

P-256 discrete-log attack ✮ Concrete reductions total TLS-ECDHE-P-256 break! Another conjecture: Should TLS users worry? Each TLS-ECDHE-P-256 attack No. Many researchers have with success probability ✕ ♣ takes “time” ✕ 2 128 ♣ 1 ❂ 2 . tried and failed to find good P-256 discrete-log attacks. Standard conjecture: For each ♣ ✷ [0 ❀ 1], each P-256 ECDL algorithm with success probability ✕ ♣ takes “time” ✕ 2 128 ♣ 1 ❂ 2 . Similar conjectures for AES-128, RSA-3072, etc.: see, e.g., 2005 Bellare–Rogaway.

P-256 discrete-log attack ✮ Concrete reductions total TLS-ECDHE-P-256 break! Another conjecture: Should TLS users worry? Each TLS-ECDHE-P-256 attack No. Many researchers have with success probability ✕ ♣ takes “time” ✕ 2 128 ♣ 1 ❂ 2 . tried and failed to find good P-256 discrete-log attacks. Why should users have any Standard conjecture: confidence in this conjecture? For each ♣ ✷ [0 ❀ 1], How many researchers each P-256 ECDL algorithm have really tried to break with success probability ✕ ♣ ECDHE-P-256? ECDSA-P-256? takes “time” ✕ 2 128 ♣ 1 ❂ 2 . ECIES-P-256? ECMQV-P-256? Similar conjectures for AES-128, Other P-256-based protocols? RSA-3072, etc.: see, e.g., Far less attention than for ECDL. 2005 Bellare–Rogaway.

discrete-log attack ✮ Concrete reductions Provable TLS-ECDHE-P-256 break! Another conjecture: Prove: if TLS users worry? Each TLS-ECDHE-P-256 attack a TLS-ECDHE-P-256 Many researchers have with success probability ✕ ♣ then there takes “time” ✕ 2 128 ♣ 1 ❂ 2 . and failed to find good a P-256 discrete-log attacks. with simila Why should users have any and success Standard conjecture: confidence in this conjecture? each ♣ ✷ [0 ❀ 1], How many researchers P-256 ECDL algorithm have really tried to break success probability ✕ ♣ ECDHE-P-256? ECDSA-P-256? “time” ✕ 2 128 ♣ 1 ❂ 2 . ECIES-P-256? ECMQV-P-256? r conjectures for AES-128, Other P-256-based protocols? RSA-3072, etc.: see, e.g., Far less attention than for ECDL. Bellare–Rogaway.