[Cfrg] Requirements for curve candidate evaluation update

[Benjamin Black <[e-mail]>]

 The CFRG, while part of IRTF, cannot separate itself from the practical
demands of IETF. The CFRG brings a different set of skills to bear, but the
outcome of its work must be pragmatic. The original list of requirements in
the request forwarded by Kenny reflected the required pragmatism in asking
only for new curves based on the 15 years of research and deployment
experience with the NIST curves. Every other aspect of the problem was and
is constrained by the existing RFCs, existing installed base, and existing
customer expectations.

Returning to the engineering requirements for new curves, the curves must
take into consideration the well-established fact that many implementations
will not be authored by professional cryptographers and almost no users of
systems relying on them will be professional cryptographers. If we require,
rather than allow, multiple curve models be implemented to support
different algorithms or for different security levels, we are increasing
complexity and hence opportunities for security and interoperability
errors. If we require new security levels, we are again working against the
existing protocols, implementation and deployment experience, customer
expectations, even user interfaces. None of these can simply be dismissed
because they are inconvenient. They are the facts on the ground.

1. Curves must be generated using a rigid process, and the more rigid the
better.

2.  The curves we recommend should only require implementation of a single
curve model, which implies:

  a) ECDHE and ECDSA must be supported with a single curve model.

  b) The same curve model must be used for all security levels.

3. For the purposes of evaluating candidates, ephemeral in ECDHE means used
exactly once per key exchange.

4. The security levels are 128, 192, and 256 bits and each curve will only
be evaluated at one of those levels.

5. No changes to coordinate wire formats.

The outcome of these is that we need 3 rigidly generated  curves in either
short Weierstrass or twisted Edwards form. Anything beyond that should be
addressed at a later point, and should not block progress on this specific
request for new curves.


b