Re: [Cfrg] ECC reboot (Was: When's the decision?)

[Ilari Liusvaara <[e-mail]>]

On Thu, Oct 16, 2014 at 04:08:18PM +0000, Paterson, Kenny wrote:
> 
> Our first task should be to finalise the requirements that we will use to
> guide the selection process. I think we are close, with a couple of
> outstanding issues:
> 
> 1. Amount of "wiggle room" that should be permitted.

Barring unforseen new way to implement base field math, there will
not be much wiggle room if performance is important consideration
and curve parameters are choosen minimally.

Heck, just see the amount of problems trying to find truly high-
performance curve near 384 bits.

> 2. A more nuanced set of hardware requirements.

Quite blunt, but: Hardware implementations are no consideration.


Why:
- This is for IETF TLS, and vast majority of endpoints are software.
- Software-optimized curves are not too bad for most hardware.
- And if they are too bad for some specialized kind of hardware,
  there already are more suitable curves in TLS.
- The kind of hardware needing such curves should not be
  contacting random peers, so making those peers capable of
  dealing with the necressary curves is feasible.


-Ilari