Re: [Cfrg] big-endian short-Weierstrass please

[Nico Williams <[e-mail]>]

On Thu, Jan 29, 2015 at 09:05:47PM +0200, Yoav Nir wrote:
> > We are not having trouble with that  in this group. Nobody disputes that any of the proposed curves are secure, or the details of generation.
> > 
> > Instead, we're arguing about endiannes. I've tried to gather which primes everyone wants in one list, crickets.  Tony Arceli posts about signatures, 5 messages. Big v. Little, 40.
> > 
> That's Parkinson’t law of triviality at work. Few understand why one prime is better than another. A few more understand about implementing signature algorithms, but we all understand endianness.

It's not.

I sent Watson a private response about that, but I guess we must have
this discussion on the list instead.

It seems consensus on curves is almost there.  The basepoint discussion
for Curve25519 could be restarted and it could draw lots of posts (I bet
it will), but otherwise I think it unsurprising that there's little
discussion.

Signature algorithms will be next up, but first things first.  Again, no
surprise about relative post numbers on this.

ECDH point representation on the wire, OTOH, may seem trivial in theory,
but it's not trivial in reality because there exists running code and
because there are patent issues.  It's utterly unsurprising that a
proposal that would instantly obsolete running, unencumbered code just
to generalize point representation so any arbitrary curve anyone can
think of can just be plugged in..., and which would also likely have the
side-effect of patent-encumbering new implementations.... would draw
many comments.

> Although that would make the signature algorithms the bike shed, and
> the endianness coffee.

We're past endianness.  Much of this thread has been about generic point
encoding (Dan Brown's proposal).

Some details really matter.  These aren't trivialities.

Nico
--