Re: [Cfrg] Hardware requirements for elliptic curves

[Robert Ransom <[e-mail]>]

On 9/2/14, Joppe Bos <[e-mail]> wrote:

> Selecting new curves in a transparent fashion, which are more secure
> compared to the current set of standardized curves by NIST, is the right
> thing to do.

I don't see why you are presupposing that new curves must be selected
-- surely the IETF should not rule out the use of previously chosen
curves such as Curve25519 and the ‘Brainpool’ curves merely because
they have multiple independent, interoperable implementations.  In
particular, the rest of your message argues for a set of curves which
(a) are defined over random-prime-order coordinate fields, and (b)
have prime order, and the Brainpool curves satisfy both of those
criteria *and* are already implemented.

(I'll leave the question of whether those properties are as desirable
in hardware implementations as you claim they are to people who have
studied those, but having prime order is the most important security
risk of the NSA curves in software implementations, so I don't see why
you are criticizing those curves' security in the same message in
which you propose retaining that security risk in newly chosen
curves.)

Perhaps you don't consider the Brainpool curves to have been chosen
‘in a transparent fashion’?  If that is your concern, I'm sure that
someone from the Brainpool consortium would be interested in
commenting on exactly how transparent their process was.


Additionally, you're raising the issue that new curves should be
chosen ‘in a transparent fashion’.  Since you are one of the authors
of <https://eprint.iacr.org/2014/130>, which ‘select[s] new curves’,
would you, and the rest of Microsoft Research, be willing to publish
all of your internal communications and records (e-mails, memoranda,
meeting notes, phone conversations, etc.) regarding that paper and
your efforts to promote adoption of the curves, algorithms, and
software described in that paper?  That would allow people who share
your concern about the transparency of the selection process to
seriously consider the curves specified in your paper.

(I don't consider transparency of the selection process to be nearly
as important as other criteria such as cross-platform performance,
efficiency of constrained implementations, support for simple
algorithms, support for efficient, simple constant-time
sum-of-scalar-multiple algorithms, and the availability of multiple
independent, interoperable implementations, all of which argue against
the curves specified in that paper.  But you, and other members of
Microsoft Research, have raised ‘transparency’ as a concern, and other
people may indeed consider transparency to be important.)


Robert Ransom