1

My organization within my company uses this KEX Algorithm in our SSH Implementation.

Another organization within my company won't connect to our servers as long as this algorithm is implemented as they claim it is "weak and vulnerable". They referenced this article:https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.7966.pdf which is interesting because nothing in there mentions it??

Could anyone help me understand the vulnerabilities of this KEX Algorithm? If it was diffie-hellman-group1-sha1 I'd understand, but ECDH_SHA2_NISTP256 I don't. It uses NIST Curve P256 and also uses SHA2 - SHA256.

I'm very keen to understand what the problem with this algorithm is... thanks for the help!

Improve this question
1
  • 1
    They're wrong. Ask them what they think you should use in KexAlgorithms.
    – Z.T.
    Commented Mar 19, 2020 at 21:39

1 Answer 1

Reset to default
1

They're probably referring to NISTP256 in the algorithm. The constants for this elliptical curve were created by the NSA, and there is some speculation that the NSA may have been specially chosen these constants to create a backdoor for themselves for this curve. See the links below for more info:

https://crypto.stackexchange.com/questions/52983/why-is-there-the-option-to-use-nist-p-256-in-gnupg

https://www.wired.com/2013/09/nsa-backdoor/

https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675929

Notwithstanding, NISTP256 is defined as:

 y^2 = x^3-3x+41058363725152142129326129780047268409114441015993725554835256314039467401291

As far as I know, the NSA has never explained how they came up with the long constant (41058...) above.

By contrast, secp256k1 (used in Bitcoin) is defined very compactly like so:

 y^2 = x^3+0x+7
Improve this answer
6
  • And there is no cryptographer who thinks the NISP P curves themselves are backdoored. You should prefer X25519 because it is easier to implement securely.
    – Z.T.
    Commented Mar 20, 2020 at 14:23
  • Z.T., See schneier.com/blog/archives/2013/09/…, where Bruce Schneier writes, 'I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry'.
    – mti2935
    Commented Mar 20, 2020 at 21:04
  • We're in 2020. People looked. No one has found a way to backdoor the constants. You'd find everyone recommending curve25519 and ed25519, but not a recent quote of anyone practicing today that they think the curves are backdoored. This comes up a lot. Recently a person had an old schneier recommendation for truecrypt as proof cryptographers approving of cipher cascades.
    – Z.T.
    Commented Mar 20, 2020 at 21:11
  • I agree with you that curve25519 is safer, to avoid corner cases where other curves may fail. This is well explained by Daniel Bernstein at safecurves.cr.yp.to. We don't know if the NSA (or anyone else) has a backdoor for P-256 (if they did, they certainly wouldn't advertise it). But, we do know that the NSA has never explained how they came up with the constant 41058363725152142129326129780047268409114441015993725554835256314039467401291 for P-256.
    – mti2935
    Commented Mar 20, 2020 at 22:00
  • I'm with Pornin on this one, whom I also consider a greater authority: crypto.stackexchange.com/a/12917/24949
    – Z.T.
    Commented Mar 20, 2020 at 22:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .