Re: [Cfrg] MAY use specified curves

[Dan Brown <[e-mail]>]

> -----Original Message-----
> From: Stephen Farrell [mailto:[e-mail]]
>
> On 09/09/14 18:03, Dan Brown wrote:
> >
> > My understanding is that many IETF WGs have applied a MUST NOT to the
> > ANSI/SECG mechanisms of specifying an elliptic curve.
>
> I'm not clear what you mean here. Can you provide citations?
>
> I think its fair to say that people generally prefer named curves for 
> simplicity and
> interop reasons but I don't know what "MUST NOT" statements you mean.

Well, I guess I was thinking of PKIX: RFC 5480 Section 2.1.1, has  a literal 
"MUST NOT"

http://tools.ietf.org/html/rfc5480#section-2

By contrast, RFC 3279 allowed specified curves, which I had forgotten.  My 
proposal is for CFRG to recommend PKIX reverting to something more the 
previous state.

But I was exactly wrong about TLS.  Oops, terribly sorry.  Haste on my part. 
Thanks for catching my mistake.  I should be more careful.

For certificates, I thought TLS followed PKIX, but I now see that RFC 4492 
refers to RFC 3279, which still allowed specified curves.  But 3279 is updated 
by 5480, so I'm not sure what rule is in effect for 4492 certificates.

Anyway, based on this poor misunderstanding, I presumed that 4492 followed 
disallowed specified curves ECDHE. My mistake here is a much worse here, 
because there's plenty of text in 4492 about specifying curves. Specifically, 
RFC 4492, Section 5.4 allows explicit prime ECDHE parameters, though it uses a 
different format than ANSI/SECG.  (In particular, it does not allow the seed 
to be sent, but I guess that's okay, because the server is sending the curve 
parameters, and the client already has to trust the server.)  Also, 4492 does 
not allow client to specify curves ... but maybe that saves servers from 
headaches.

I vaguely recall some TLS WG list emails agreeing to move towards named DHE 
parameters, and perhaps dropping DHE parameters.  Perhaps the TLS WG plans on 
doing the same for ECDHE?  If so, then my proposal is for CFRG to ask to 
retain the option of specified curves.

Since I was so wrong about TLS, my understanding about other WGs is probably 
wrong too: they allow users to specify their own curves.

Well, now that it seems many IETF WG already allow users to specify their own 
curves, CFRG might suggest ways to specify curves (and formats) for the new 
types of curves of being proposed.  That would be a formatting issue though, 
not a curve choice issue.