ietf
[Top] [All Lists]

Re: Randomness sources for the IETF 2015-2016 Nomcom Selection

2015-06-23 08:18:21
From a security point of view, the question is not whether the inputs are
random, it is whether they are vulnerable to manipulation. Having more
inputs does not make a system more robust against this type of attack, it
makes it more vulnerable.

If we are changing our ECC curves due to the possibility that NIST might
have been suborned, we should not be using a number so obviously capable of
being manipulated as an input.

The reason that we can trust lottery numbers is not that they are
absolutely immune from tampering. We can trust them because anyone who
could be bothered to tamper with them has a much bigger incentive than
manipulating the IETF NOMCON choices. This means that we can put a dollar
value on the manipulation, a few hundred million USD.

The issue isn't just whether an attack is likely, it is a matter of
reputation. We are not changing our curves because we believe NIST
manipulated them. We are changing our curves because some Major desperate
to make Colonel and keep their job wrote a bunch of silly slides that
leaked. And given that the agency concerned has an up-or-out promotion
policy and the person in charge only values attack as a strategy, the
slides were all designed to present the work done as attacking and
manipulating.

[As an aside, expecting people who work in fear of their jobs to take
courageous acts against their commanding officer when ordered to commit
illegal or immoral acts is naive at best.]

I suggest we remove the US debt from the equation entirely as it is not an
appropriate source of randomness. The internal means of construction is not
opaque, nor is it automatic. Ergodicity is not the test that matters,
transparency is.
<Prev in Thread] Current Thread [Next in Thread>