Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Stephen Farrell <[e-mail]>]

On 02/09/14 16:19, Watson Ladd wrote:
> On Tue, Sep 2, 2014 at 1:30 AM, Stephen Farrell
> <[e-mail]> wrote:
>>
>> Just on this point...
>>
>> On 02/09/14 02:50, Benjamin Black wrote:
>>> The various working groups and standards bodies have already answered the
>>> question of what goes on the wire.
>>
>> That's not correct. When CFRG finish doing a great job here, then
>> the TLS WG will have to assign new codepoints for ciphersuites and
>> there is nothing stopping them defining new encodings at that point
>> if that's needed. That'd just not be a big deal. And the same is
>> true of other IETF activities. So what goes on the wire should be
>> a non-issue for this discussion really.
> 
> Aren't we replacing SEC1? And doesn't SEC1 specify encodings, which
> other WGs use?

CFRG is not replacing anything, but rather picking new additional
curves.

If those new curves turn out to be way more popular then maybe
over time they'll displace use of others, but only time will
tell that, not CFRG.

> If we end up saying "pairs of integers" then we get a mess, where
> software implementing the curves has to implement a large number of
> encodings. If we specify things as strings of bytes, that's easy to
> deal with. I've heard some people say this was a mistake, but I am
> unconvinced by those arguments. 

The point is that afaik none of those arguments help to pick
new curves. If CFRG want to suggest something for on-the-wire
formats after having picked some curves that's fine and it may
or may not be adopted by various IETF protocols, depending on
how well it fits their needs I guess.

Main point is: I don't believe wire-format issues make any
difference when picking new curves.

S.

> 
> Sincerely,
> Watson Ladd
> 
>