Re: [Cfrg] Adoption request: draft-hdevalence-cfrg-ristretto

"Paterson Kenneth" <> Wed, 24 July 2019 10:29 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id B73A412014B for <>; Wed, 24 Jul 2019 03:29:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.197
X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id piLk1JL0Tj8o for <>; Wed, 24 Jul 2019 03:29:37 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 3DDE91200D7 for <>; Wed, 24 Jul 2019 03:29:36 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.3.468.0; Wed, 24 Jul 2019 12:29:24 +0200
Received: from (2001:67c:10ec:5602::26) by (2001:67c:10ec:5602::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Wed, 24 Jul 2019 12:29:28 +0200
Received: from ([fe80::7114:d795:2066:d254]) by ([fe80::7114:d795:2066:d254%3]) with mapi id 15.01.1713.007; Wed, 24 Jul 2019 12:29:28 +0200
From: "Paterson Kenneth" <>
To: Filippo Valsorda <>, "" <>
CC: "" <>
Thread-Topic: [Cfrg] Adoption request: draft-hdevalence-cfrg-ristretto
Thread-Index: AQHVDP8m6wqfcmDx0kC/c3U6qFpzkabZ2IkAgAAiz4A=
Date: Wed, 24 Jul 2019 10:29:28 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: de-CH, en-US
Content-Language: en-GB
x-originating-ip: []
x-tm-snts-smtp: AE4E04FD59F0AE6FA4176D9135729CB93901B63A0EEA0096220E43CD35DC44322000:8
Content-Type: text/plain; charset="utf-8"
Content-ID: <>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [Cfrg] Adoption request: draft-hdevalence-cfrg-ristretto
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 24 Jul 2019 10:29:40 -0000

Hi Filippo,

It's on the chair's "to do" list to reach out to the authors of that document and discuss the next steps. 

Thanks for your patience during the delay. There's a lot of CFRG docs in the works at the moment.


Kenny (for the chairs)

-----Original Message-----
From: Cfrg <> on behalf of Filippo Valsorda <>
Date: Wednesday, 24 July 2019 at 12:26
To: "" <>
Cc: "" <>
Subject: Re: [Cfrg] Adoption request: draft-hdevalence-cfrg-ristretto

    What are the next steps in discussing adoption of this draft?
    I believe it would be especially timely, as ristretto255 provides a
    better prime-order group than Curve25519 for OPRFs and PAKEs that are
    being discussed by this group.
    Moreover, Cas Cremers and Dennis Jackson recently published a new round
    of small subgroup attacks that would have been avoided by Ristretto
    adoption, as they mention in the paper.
    2019-05-18 00:22 GMT+02:00 Filippo Valsorda <>io>:
    > Hello,
    > I'd like to request for the group to adopt
    > draft-hdevalence-cfrg-ristretto for publication as an Informational RFC.
    > Ristretto255 is a prime-order group designed by Henry de Valence,
    > based on Mike Hamburg's Decaf. It provides a safe, efficient, and
    > implementor-friendly abstraction for a prime-order group, enabling safer
    > and simpler design of higher-level protocols. Its order is the same as
    > the prime-order subgroup of Curve25519.
    > Ristretto255 can easily be implemented on top of an existing Curve25519
    > library, and the authors are providing multiple implementations in
    > different languages: curve25519-dalek in Rust, by Isis Lovecruft
    > and Henry de Valence; curve25519-elisabeth in Java, by Jack Grigg;
    > ristretto255 in Go (implemented clean-room from the spec),
    > by George Tankersley and myself; and ristretto-donna (forthcoming) in
    > C, by Isis Lovecruft. We are also aware of other implementations we
    > have not personally tested for interoperability, including one in Frank
    > Denis's libsodium.
    > Importantly, ristretto255 is a flexible abstraction, and can be
    > implemented with different, more efficient curves than Curve25519. The
    > draft only provides implementation details for a Curve25519 backend,
    > but it defines the interface contract which is required of compliant
    > implementations, allowing alternate backends.
    > The group has already been adopted by some higher level protocols,
    > including Bulletproofs by Chain, and has been subject of discussion on
    > this list, including some good posts by Tony Arcieri. More information
    > is available at and in the draft, and the
    > authors and I are available to answer questions.
    > Best, Filippo
    Cfrg mailing list