[Cfrg] Progress on curve recommendations for TLS WG

["Paterson, Kenny" <[e-mail]>]

Dear CFRG,

We made good progress last week in Toronto and on the mailing list in
discussing requirements for curve selection, as well as getting into some
of the specifics of the different curve options.

The chairs have had requests to increase the time given to our discussion
of requirements in the light of the Toronto meeting, and we are happy to
accommodate that. We therefore plan to extend the previously announced
schedule so that this initial phase will run for another 2 weeks (until
Friday 8th August). We will then run the second phase (focussing on
concrete curve proposals) for 4 weeks, as previously planned.

Whilst it may be tempting to jump in and start discussing concrete
performance aspects of the different, specific curve proposals, or drift
off onto other topics entirely, the chairs would like to ask everyone to
try to focus on requirements for a bit longer. Here are a few questions to
help keep things on track and seed further discussion:


- What is the cost of keeping backwards compatibility with existing
defined point formats in RFC 4492, if any, for different curve shapes
(Edwards, twisted Edwards, Montgomery, Weierstrass-only form)?

- If ephemeral really means ephemeral, what are the implications for the
mix of fixed-base/variable-base computations in ECDHE and what, if any,
are the implications for the choice of curve type?

- Correspondingly, what are the implications for our choices if we accept
that ephemeral reuse is the expected behaviour?

- Do the current proposals (Curve25519 and friends, and the NUMS curves)
provide an adequate degree of rigidity that is likely to satisfy the
widest set of commentators? Or should we be thinking about generating
fresh curves using a public process having verifiably random inputs? What
would the likely impact be on performance?

- Would selecting curves that are not in Weierstrass form materially slow
down deployment?



Thanks for your considered inputs so far.

Regards,

Kenny (for the chairs)