[Cfrg] My comments on TLS requirements from today's interim

[Eric Rescorla <[e-mail]>]

Here's what I think would best benefit TLS as an output of this curve
selection
process:

- An IETF-wide set of curves so we can share them with IPsec, SSH, etc.

- A single curve/set of curves at each security level for each application.
  I say a set of curves because it may be the case that you have one curve
  for signature and one for key agreement, but you shouldn't have,
  say, four curves used for key agreement at the 256-bit level. [0]

- Minimally cover the 256- and 512-bit security levels. I think 384 would
  be fine if there was a strong reason, but it's probably not necessary.

- It would be nice if there was some chance that these curves could
  have some chance of being FIPS-approved, so they could potentially
  displace the NIST curves. It may be very difficult to get certainty here.

This obviously isn't an exclusive list of desiderata, but I wanted to avoid
duplication with David's otherwise quite nice list.

-Ekr