Re: [Cfrg] Curve manipulation, revisited

On Tue, Dec 30, 2014 at 12:33 PM, Paul Hoffman <paul.hoffman@vpnc.org> wrote:
> On Dec 29, 2014, at 6:52 PM, Tony Arcieri <bascule@gmail.com> wrote:
>> I think you can avoid this slippery slope by the CFRG recommending Curve25519 as one of potentially many curves at a 128-bit security level, for now, as an interim solution, simply to avoid the current situation of apparent infinite deadlock.
>
> No, please no. An "interim solution" signature algorithm is stillborn. Few people would want to take the operational effort to create *and maintain* keys for an interim solution when the current solution (P256) is good enough.
>
> If the CFRG cannot come to an agreement on a curve, a signature algorithm, and the necessary format additions, for 128-strength ECC, it should tell the IETF so as soon as possible. Stretching this out with interim values and half-solutions will be worse than claiming defeat.

We already have agreement: It's a Montgomery x-coordinate solution
modulo the prime 2^255-19, with the curve equal to that of Curve25519.
Literally the only difference is the basepoint, which is irrelevant to
security. This is hidden behind the dramatically increased stream of
emails, but it's there.

For signatures, NUMS isn't opposed to EdDSA. Rather they would like to
see FrankenECDSA, which may be slightly easier for some to adopt.

I strongly urge that we finish off the 128-bit level ASAP.

>
> --Paul Hoffman
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin