Re: [Cfrg] CFRG feedback on signing with secp256k1 curve

Tangential note:

In SSH, RFC 5656 defines a standard algorithm identifier format for ECDSA
and ECDH using any curve that has an OID. I'm not aware of many other
implementations, but exactly because of the reasoning you point out
(Bitcoin is a huge target), since 2014, Bitvise SSH Server and SSH Client
have supported secp256k1 in SSH under the following algorithm names:

Key exchange:

ecdh-sha2-1.3.132.0.10

Public key authentication (server or client):

ecdsa-sha2-1.3.132.0.10

On Mon, Jun 11, 2018 at 7:03 PM, Mike Jones <
Michael.Jones=40microsoft.com@dmarc.ietf.org> wrote:

> Dear CFRG,
>
>
>
> You’ll recall that the “secp256k1” elliptic curve is described by Dan
> Brown and Certicom in “SEC 2: Recommended Elliptic Curve Domain Parameters”
> http://www.secg.org/sec2-v2.pdf (the same document that described the
> secp256r1 curve – a.k.a., P-256).
>
>
>
> I recently wrote  https://tools.ietf.org/html/draft-jones-webauthn-
> secp256k1-00
> <https://tools.ietf..org/html/draft-jones-webauthn-secp256k1-00> with a
> very specific and narrow purpose: to register JOSE and COSE curve
> identifiers for the SECG secp256k1 elliptic curve and associated algorithm
> identifiers for signing.   This curve is already being used by FIDO UAF,
> the W3C Verifiable Claims interest group, and several blockchain projects.
> I want to get standard identifiers registered so these projects can use
> standards-based, rather than ad-hoc, cryptographic representations.  A path
> forward for this document is being discussed at secdispatch@ietf.org.
>
>
>
> As part of the SECDISPATCH evaluation, Ekr had suggested that I ask the
> CFRG for references to security analyses of secp256k1.  No matter what
> you or I may think of Blockchain, because Blockchain is using secp256k1 and
> is under tremendous scrutiny, it’s my assumption that if major security
> flaws were known, people would be widely talking about them.  But I’d like
> to replace my assumption with an actual security analysis or two and
> thoughts from the CFRG, if possible.
>
>
>
>                                                        Thanks,
>
>                                                        -- Mike
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
>