Re: [Cfrg] Curve manipulation, revisited

[Adam Langley <[e-mail]>]

On Thu, Dec 25, 2014 at 7:33 PM, Watson Ladd <[e-mail]> wrote:
> It's important not to confuse "rigidity" with actually constraining
> the choice of curve meaningfully. The question is not how many curves
> can be generated, but how many curves the user will accept.

Certainly. Indeed, rejecting curve25519 because of "rigidity" appears
to me to imply accepting that:

1) There are numerous, devastating pitfalls in the space of
sensible-looking curves.
2) And yet, nobody has ever caught even a glimpse of them.
3) And yet, they are dense enough that someone could easily steer a
curve into one.
4) And yet, not so dense that one can't steer a "rigid" curve into one.

That seems like codswallop to me, and possibly to Microsoft too.
However, I think it's understandable if Microsoft have a bunch of
customers who do not specialise in cryptography and yet look with
suspicion at every decision Microsoft make in this area, and thus MS
want to make as few as possible. (I wish MS had generally been more
communicative about their motivations on the list so that I didn't
have to guess.)

It would be nice if we didn't have to worry about such shoddy
suspicions. (Microsoft might feel the same.) But, as I mentioned,
failing to reach agreement with Microsoft would be a bad outcome.

> Exactly. It is now the deadline: are we going to miss it because we
> cannot get the 128 bit level out, despite unanimity on what it should
> be?

I would very much welcome it if we could work on trying to get
curve25519 out the door. I'm sure that there are still things that
people can disagree about but everyone appears to be within an isogeny
of a common place.

> Basepoints and isogenies don't change security: if the Microsoft curve
> is isogenous to Curve25519, why not use Curve25519?

At the moment, because of a desire for a single curve-generation
procedure, I think. Adding special cases to steer the output to match
curve25519 is distasteful and looks like rigging the procedure. (Of
course, from a security point of view, that's nonsense. I've also not
seen anyone outside of MS express the opinion that a curve-generation
procedure is even desirable. But, to make progress, people need to try
and understand Microsoft's position.)

(I'll deal with the argument about the value of a large curve in a
different email becasue Davil Gil has a reply on that topic too.)


Cheers

AGL