Re: [CFRG] compact representation and HPKE

[Mike Hamburg <[e-mail]>]

> On Feb 12, 2021, at 5:59 PM, Paul Hoffman <[e-mail]> wrote:
> 
> On 12 Feb 2021, at 13:40, Christopher Wood wrote:
> 
>> (I don't think RFC 6090 or the related expired draft [1] rise to the level of a standard format)>
>> [1] https://tools.ietf.org/html/draft-jivsov-ecc-compact-05
> 
> For those of you who were not here a decade ago:
> 
> - RFC 6090 was never meant to be a standard. It was written and published to show that there was ample prior art for elliptic curves against some patent concerns that people had. To a large extent, it met that goal and discussions of ECC stopped ending with "but what about the patents", then they stopped having patents come up at all.

It’s worth mentioning, on the subject of “but what about the patents”: the fastest set of x-only formulas I’m aware of, 11M/bit as described in https://eprint.iacr.org/2020/437.pdf <https://eprint.iacr.org/2020/437.pdf>, are patented by my employer (not my choice to make).  On the second-fastest set I’m aware of, 12M/bit as described in https://ches.2017.rump.cr.yp.to/a1933e522beb16591d9dc8e373ad7079.pdf <https://ches.2017.rump.cr.yp.to/a1933e522beb16591d9dc8e373ad7079.pdf>, I’m not aware of any patents.

As for HPKE: I’m always sad to see a technically better solution passed up, especially since I’ve done so much research to improve it.  But if it’s not standardized or widely supported at all yet, then a decision to use the existing structures makes sense.  I’m actually pretty surprised that it’s not standardized anywhere: it’s weird that everyone uses x-only output with short Weierstrass curves, but nobody uses x-only wire formats with them.

For FIPS: would HPKE be FIPS-compliant anyway?  Don’t FIPS-compliant ECC private keys have to be generated directly from an approved DRBG, or something like that?

Regards,
— Mike