Re: [Cfrg] big-endian short-Weierstrass please

[Andrey Jivsov <[e-mail]>]

On 01/29/2015 05:21 AM, Phillip Hallam-Baker wrote:
> So by FIPS-140 equivalent, what is meant is something that we can get a
> group of experts to agree is equivalent and safe. It probably means that
> the hardware is certified FIPS-140 but not necessarily for the
> particular algorithm. This may or may not require wording changes but I
> don't expect they would be controversial.

Unless the new curve is accepted along the lines of P-256 by NIST, it 
will be treated no much differently than CAMELIA (or DES).

Without this change, the new curve is a Non-Approved security function 
and it can only be used in non-Approved modes of operation. Crypto 
module documentation will need to make this clear, per FIPS 140-2.

It's a known trick to certify only AES and then somehow make an 
impression that other algorithms are covered by the same module. NIST 
put multiple notes to make this harder. Thus, NIST will need to 
explicitly bless the new curve. A precedent for this is the TLS KDF.