Re: [Cfrg] big-endian short-Weierstrass please

[Nico Williams <[e-mail]>]

On Wed, Jan 28, 2015 at 05:30:28PM -0500, Daniel Kahn Gillmor wrote:
> On Wed 2015-01-28 16:23:27 -0500, Dan Brown wrote:
> > For example, RFC 4492 allows curves to be specified in Weierstrass
> > form, not just as named form.  I don't know if any TLS implementations
> > support the specified curve option, but if they do, then it would be
> > nice if the new implementations could talk to them, using the new
> > curves.
> 
> Over in the TLS WG, we're working on actively deprecating the custom
> curve selection mechanism and moving strictly toward pre-named curves
> (this is true for finite-field DH as well).  Custom curve and FFDHE
> group selection will be gone in TLS 1.3.
> 
> oThe over-flexibility in EC group selection isn't widely used, and when
> it is used, there is no clear way for a receiving implementation to have
> confidence in the structure of the arbitrary curves provided (even
> simple primality-testing is probably too expensive for most to do at
> runtime), or to have a reasonable (efficient, constant-time)
> implementation.
> 
> I don't think this is a particularly useful half-measure.  I'd rather
> see implementations pick up new, reasonably-vetted curves than try to
> muddle through supporting arbitrary curves provided by the peer.

+1