Re: [Cfrg] Citing specs in specs

[Watson Ladd <[e-mail]>]

Dear all,
This is provisionally my last word on the matter.

Any consensus based process only works if people will block a largely
formed consensus for a good reason only. A document being unclear, or
having unanalyzed security properties, or major issues with regards to
alternatives not being discussed are good reasons. But the argument
that Paul I think is making, that until the CFRG produces a draft ala
RFC 6090 for Edwards curve we cannot use them, is fundamentally
unconvincing.

First off, let me note that black box implementations of Curve25519
using the paper are possible: I've written them, Adam Langley has
written them, as have lots of other people. So that leaves the
argument that the implementations require too much knowledge about
cryptography, and that such an issue is worth blocking specs.

The simplest argument for why it is unconvincing is the date of RFC
6090 vs. the dates of protocols that included Suite B and ECC. RFC
4869 includes Suite B a full 4 years before RFC 6090 was published.
Now, it is possible that Paul's argument was valid, but simply wasn't
raised at the time RFC 4869 was being published. But I don't see any
evidence that implementors of RFC 4869 were hamstrung by the
nonexistence of RFC 6090.

The second reason I am unconvinced is that I don't see why we
shouldn't assume the availability of standard references such as the
Handbook Of Elliptic and Hyperelliptic Curve Cryptography, or volume 2
of Knuth, to implementors. Such documents are available for far less
money than ISO standards, and in many regions of North America, Europe
and Asia, can be found for free in the library. The goal of a spec is
to explain to humans what is to be done: including excessive
information makes this much harder.

Finally, Mr. Lambert writes in terms of the "onus" being on CFRG to
produce such a document, which he calls a "usable normative
reference". Such a bare assertion is entirely unconvincing.
Furthermore, CFRG owes Paul nothing. While I would be happy to review
such a document for accuracy, I have no obligation to review or
produce such a document, and the same holds for all the members of the
CFRG. I can just as easily say that Mr. Lambert has the onus to
produce such a document.

I've changed my mind about the desirability of such a document as Mr.
Lambert wants. It would be nice if it existed, and it would be a nice
project to learn CWEB. However, I see no reason to consider the
absence of such a document a good reason to block
draft-josefsson-tls-curve25519-04.

Sincerely,
Watson Ladd