Re: [Cfrg] Curve manipulation, revisited

[Benjamin Black <[e-mail]>]

On Mon, Dec 29, 2014 at 10:54 AM, Salz, Rich <[e-mail]> wrote:

>
> > The signatures on X509 certificates are a separable issue. But the
> signatures
> > in the ServerKeyExchange using the private key associated with the public
> > key in the X509 certificates are very much a part of TLS.
>
> True, yes, foggy from too much eggnog, I guess.
>
> > When measuring the performance of the TLS handshakes, the ECDHE
> > derivation takes a similar amount of time as the ECDSA signature. That
> is the
> > reason for moving away from RSA public keys to ECDSA public keys. If we
> can
> > use public keys which will be even faster, that’s a net win.
> >
> > So again, why not?
>
> Two major reasons.  X25519 is useful by itself without Ed25519 so there's
> no reason to tie them together.  Having them separate docs lets them
> progress at their own, natural, rate.  Which brings me to my second reason:
> I think there are no valid reasons to delay X25519, while the discussion
> around Ed25519 is, well, let's just say it's still at the pre-consensus
> state. :)  Does that make sense?
>
>
Not to get all Watson on you, but does that mean you don't have a strong
opinion on the twisted Edwards form?


b