Re: [Cfrg] big-endian short-Weierstrass please

[Nico Williams <[e-mail]>]

On Thu, Jan 29, 2015 at 05:58:03PM +0000, Dan Brown wrote:
> >From: Watson Ladd [mailto:[e-mail]]
> >This is not how TLS negotiation works: the client offers and the server 
> >picks. Due to vulnerabilities in all versions of TLS (still unfixed) one 
> >always has to check the offered parameters for correctness.
> 
> [DB] Ah, too bad. I guess named curves (and FFDHE groups) is, among other 
> things, one way to fix this problem with TLS.  (I vaguely recalled a proposal 
> for the server being able to suggest alternatives outside the clients' list, I 
> guess I misremembered.)
> 
> Anyway, to paraphrase others, a downside of TLS limiting curves to a small 
> set, is this limitation can be spun sourly, albeit a tad unfairly, as 
> pressuring users to use particular curves. That said, leaving in arbitrary 
> curves, can also be spun badly, too, catch 22.

We can haz both even, though I don't see the value in it; known curves
FTW.  The key is to have a relatively open curve registry (open -> less
than IESG Protocol Action should be needed to register, probably Expert
review).

The same is true for traditional DH.  We've had known groups for a long
time.  Some protocols (e.g., SSHv2) allow negotiation of arbitrary
groups, but a) it takes a long time to generate them, b) it takes longer
to validate (then use) them than it would to just use an off-the-shelf
group.  I would say that arbitrary group negotiation is a failure in all
cases.

> >That's on top of the fact that people don't want to use Curve25519 because 
> >it's Curve25519. They want to use it because the design choices support high 
> >speed secure implementations.
> 
> [DB] Right, but other users might want to use some other curves with high 
> speed secure implementations, e.g., maybe a larger curve, but they disagree 
> with CFRG advice about rigidity, etc.

See point above about a curve registry.  For protocols like SSHv2 where
there's a large private-use namespace for curve names, a registry is not
even required, and the Internet can come to consensus by market
mechanisms.

A generic point format for all curves to use is simply not something we
need for anyone's favorite curves (or curve families) to be deployable.

Nico
--