this nicely completes the “rehabilitation arc” of NIST elliptic curve cryptography, which I would now personally recommend over Curve25519/Ed25519/X25519
What are the benefits of the NIST curves? I know that the curve25519 cofactor caused problems, but I thought that was mitigated by ristretto,
I have a list I should publish at some point of mild advantages of one over the other but really what dominates is that P-256 is everywhere, including in hardware, and once the benefits are so marginal and mixed and context-specific I would rather write one very good implementation of one curve than split my energy across two.
Anyway, it's all moot now: the right choice between ECDSA P-256 and Ed25519 is ML-DSA-44.
I've seen interop issues with people disabling ECDSA for these worries, and I often run into incompatibilities between protocols that only support ed25519, and my hardware tokens/TPMs that only support ECDSA.
This contributed to enduring conspiracy theories, which had significant appeal among the non-specialist public (although many have since moved on to other, adjacent, conspiracy theories). All this speculation harmed confidence in robust cryptographic systems and was part of my motivation for the bounty.
This week’s findings completely rule out the technique described by Bernstein and Lange.
This feels a bit harsh? If it was only this week's findings that completely ruled this out, is it so irrational to have been sceptical about ECDSA?
If you are thinking “well, this could be bad, or it could be nothing!” I need you to recognize how immediately dispositive that is. The bet is not “are you 100% sure a CRQC will exist in 2030?”, the bet is “are you 100% sure a CRQC will NOT exist in 2030?”
YogurtGuy | an hour ago
What are the benefits of the NIST curves? I know that the curve25519 cofactor caused problems, but I thought that was mitigated by ristretto,
[OP] FiloSottile | 48 minutes ago
I have a list I should publish at some point of mild advantages of one over the other but really what dominates is that P-256 is everywhere, including in hardware, and once the benefits are so marginal and mixed and context-specific I would rather write one very good implementation of one curve than split my energy across two.
Anyway, it's all moot now: the right choice between ECDSA P-256 and Ed25519 is ML-DSA-44.
tuxes | 6 minutes ago
Great news.
I've seen interop issues with people disabling ECDSA for these worries, and I often run into incompatibilities between protocols that only support ed25519, and my hardware tokens/TPMs that only support ECDSA.
Hopefully this will persuade https://github.com/jtesta/ssh-audit to not flag ECDSA, also a source of interop issues.
This feels a bit harsh? If it was only this week's findings that completely ruled this out, is it so irrational to have been sceptical about ECDSA?
As the author persuasively argues in their post on accelerated PQC timelines: