Subnostr

Long ago the US government wanted to put a "clipper chip" in everybody's computer. This chip would encrypted traffic (wasn't common at the time) but witih a backdoor so that law enforcement could see your data.

Later NIST recommended Dual_EC_DRBG encryption that suspiciously could have been constructed with a backdoor, and later evidence from Snowden indicated that it probably did have this backdoor.

Also the P curves (P-224, P-256, and P-384) were constructed with numbers that are unexplained and could weaken the algorithm if you know the secret of how those numbers were chosen.

Chrome and Firefox do not support ed25519 in TLS, but they do support the P-curves.

I suspect TLS isn't secure against the NSA unless both sides are using algorithms that the NSA can't break, which in the browser HTTP world is hardly possible.

ed25519 isn't the only algorithm with nothing up it's sleeve (https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number) but it has become the most popular and is quite efficient.

In the rust world, if you control both endpoints, you can use a more trustworthy TLS like https://github.com/mikedilger/alt-tls If you don't control both endpoints, the TLS will probably fail to negotiate a secure algorithm.

nostr:nevent1qqs0f0q9fcmwne865ecu6xy6qy0xl53pws2ewhpxtf429huj4hlrn2qfuvutz

Reply to this note

Please Login to reply.

Discussion

ben 9mo ago

was just wondering how your work on this was coming. ironically also rereading No Place To Hide.

Mike Dilger ☑️ 9mo ago

alt-tls works and I'm considering it complete.

I was going to try secp256k1 Schnorr signatures, but I'm a bit stuck in the morass of PKIX and their numbering scheme, and the fact that they don't have a number for this signature algorithm. That doesn't mean I couldn't implement it, but it does mean I couldn't signal it across the TLS negotiation or in the certificate.

ben 9mo ago

makes sense. I wonder if we’ll see more adoption of schnorr signatures outside of this niche.

Mike Dilger ☑️ 9mo ago

I read Edward Snowden's book. I didn't read this one. I'll order it now.

Emperor Kuzco 9mo ago

I remember the Intel Pentium II serial number problem.

Mike Dilger ☑️ 9mo ago

Did you notice the AMD Zen3 RDRAND "bug"? Somehow, a hardware circuit consisting of a different odd number of noise diodes for each bit, and a hardware implementation of a hash function for whitening, always generated the number 0xFFFFFFFF (-1). I took it as a signal from a technical person at AMD, letting us all know that it wasn't really hardcoded and there was some kind of backddoor to disable it. And I'm glad linux never relied upon RDRAND.

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 9mo ago

just sayin, they also left out the koblitz version of P256, which is our known and loved secp256k1

the propaganda campaign against the koblitz curve was incredible, yet somehow they have given ed25519 a pass... which smells pretty fishy to me, almost like, they KNOW that the koblitz curve is even more secure than the edwards twisted curve

the only solution, as i see it, is a noise protocol implementation that uses sha256 and secp256k1 for HMAC, and i started on building one for #golang

i already spotted this egregiously obvious manipulation in the "academic" scene years ago, and i'm pretty sure that nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 picked bip-340 secp256k1 X-only schnorr signatures for #nostr

you know why i don't trust edwards?

because all the shitcoins used it

because your precious fucking rust favorizes it

funny how still there is no viable shortcut to bruteforcing bitcoin's koblitz curve group now isn't it?

nice to see that you are thinking about this though, welcome to the NIST cryptography skeptics club

fiatjaf 9mo ago

I have to agree on this one. ed25519 is suspicious by association.

Mike Dilger ☑️ 9mo ago

I don't think the koblitz curve is bad as long as you program around its shortcomings. I didn't know there was an intense campaign against secp256k1. That is somewhat suspicious.

But secp256k1 does have some problems that ed25519 clearly does not have. It has some mathematical properties which open up certain kinds of attacks on the discrete log problem (several low numbered CM field discriminants, ladder cofactor of 1) and it has some properties making it hard to code correctly, specifically that the keys are not indistinguishable from random bits, and you cannot use just any sequence of random bits as a secret key. Nonetheless it hasn't been effectively cracked.

ed25519 has been given a "pass" because it has proven "nothing up it's sleeve" without any of these theoretical shortcomings. So I really am not suspicious of it. But notice that it was given a pass NOT by actual browsers, just by the RFCs. The actual browsers leave it out.

Everybody here seems to worship Satoshi and distrust everybody else, and you are welcome to make your choices. But I don't agree.

ᴛʜᴇ ᴅᴇᴀᴛʜ ᴏꜰ ᴍʟᴇᴋᴜ 9mo ago

yeah, i seem to recall that there is a problem with the koblitz curve with relation to hierarchic deterministic keychain derivations, some weakness that made it easier to figure out upstream keys if you breach a downstream one

also if i remember correctly, the signature calculation for ed25519 is a little faster than even schnorr secp256k1, though that might just be because of using blake2, now i think about it

we have secp256k1 schnorr signatures in our relay and client libraries, and they are battle tested, and also most platforms now have a SIMD implementation of SHA256 which closes the gap a lot

there is a big element of contrarian anti-hipster in the nostr and bitcoin culture though, *except* for a large part of those who are instrumental in approving everything and elevated to high visibility artificially by the people running primal

not trusting things that are beeing deceptively promoted seems like a wise tactic in my view

progressivism in all its forms seems to quickly devolve into debauchery

Rand 9mo ago

t *Y*

Autumn Sun ☀️🌘☯️ 9mo ago

And one of the more recent actions of the management of Mozilla (after Brendan Eich was ousted) was to cut development and engineering resources while redirecting funds to the new managements compensation plans plus focusing on useless fluff like user interface colour schemes and ancillary services like a mozilla fediverse instance (now dead, thankfully), mozilla vpn ( just mullvad with branding), and a "personal data scrubbing service" whose chief person was a person that used to own a data brokerage.

All while taking a huge glob og Google money every year.

But don't sweat it, Mozilla now has a new LOGO which somehow communicates their values and new found company focus to the users!

It all stinks to high heaven.

Mike Dilger ☑️ 9mo ago

Yeah I hate where Mozilla went. But when using the web stack, I don't like the others either. I'm really less and less interested in the entire web stack. I think it has become hyper complex, and that is not a good thing.

Of course I still use the web. But when I make technology I try to avoid it. It's not necessary for new technology.