Re: [Cfrg] A draft merging rpgecc and thecurve25519function.

Adam Langley <agl@imperialviolet.org> Fri, 02 January 2015 00:51 UTC

Return-Path: <alangley@gmail.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7E3B1A8033 for <cfrg@ietfa.amsl.com>; Thu, 1 Jan 2015 16:51:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.278
X-Spam-Level:
X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pa-3WzQ1YnVD for <cfrg@ietfa.amsl.com>; Thu, 1 Jan 2015 16:51:20 -0800 (PST)
Received: from mail-la0-x233.google.com (mail-la0-x233.google.com [IPv6:2a00:1450:4010:c03::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 197721A8032 for <cfrg@irtf.org>; Thu, 1 Jan 2015 16:51:20 -0800 (PST)
Received: by mail-la0-f51.google.com with SMTP id ms9so14895183lab.24 for <cfrg@irtf.org>; Thu, 01 Jan 2015 16:51:18 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=32yxfjdBShWAopYrwmPd/oex5OddajwHrKAWENu9LpA=; b=maXQVrDPKR0c7AE5C8yM0KjzrdlrLPsYDsVjpUicn4qm+MyTnzbwuuxSv5fFTGSCt6 NRC1idEdiGjZ5n8NNJasmT8itug77rdBb69QExTmTJ4lahBJFzW9zu9YhhDwpEKVpTDj nfNMvuK7KaYYX0l6Gd5z+XGP7zNmwIsS5eskbOvOirp4OpLR7dLfPYOtClO4EoZIOz3G QoSJMwxEecfdJBLMCbhtJpDnwiObuZkU0aItkLFQgeDT1TKejfTqO5P/ycs4E+dE/J9x HTT8V8OMxwIe22MBe5jHkIkM4shFP84DMELdRKQQY3GLR6TWr1rekNvFimzE2MWMY09T oPEg==
MIME-Version: 1.0
X-Received: by 10.112.125.202 with SMTP id ms10mr36225304lbb.33.1420159878376; Thu, 01 Jan 2015 16:51:18 -0800 (PST)
Sender: alangley@gmail.com
Received: by 10.112.114.225 with HTTP; Thu, 1 Jan 2015 16:51:18 -0800 (PST)
In-Reply-To: <CACsn0c=GVLh3vYm=dxW=FKKx3Zd=5L6qdh8m_xzjZpb+mk9+0w@mail.gmail.com>
References: <CAMfhd9Vi=VJw2NW1CX1aE_qjXFmQ1Cmd1F4s7C9eEvuVog-f=Q@mail.gmail.com> <CAMfhd9UAkNBXvof3SgJLQ4Ld6=jNdvLnpCUrMsJFUCepGZytqA@mail.gmail.com> <CACsn0c=GVLh3vYm=dxW=FKKx3Zd=5L6qdh8m_xzjZpb+mk9+0w@mail.gmail.com>
Date: Thu, 1 Jan 2015 16:51:18 -0800
X-Google-Sender-Auth: es_lzgYWMkfAd-_16kNZhY7FsPA
Message-ID: <CAMfhd9XJiatX7KoXmYbgoMPkyEV=kprEhZGW33wGZHZ4XbUX7w@mail.gmail.com>
From: Adam Langley <agl@imperialviolet.org>
To: Watson Ladd <watsonbladd@gmail.com>
Content-Type: text/plain; charset=UTF-8
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/OV_rFrKtzn0e4C7r_gmzLmH9RUs
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] A draft merging rpgecc and thecurve25519function.
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Jan 2015 00:51:22 -0000

On Thu, Jan 1, 2015 at 4:08 PM, Watson Ladd <watsonbladd@gmail.com> wrote:
> Is it just me, or is this the draft I uploaded a couple weeks ago,
> plus typos, and a section about an algorithm that gets used only to
> have its result ignored?

Is "the draft I uploaded a couple weeks ago" referring to
draft-turner-thecurve25519function-01? If so, then somewhat yes. (The
only other draft I see from you is draft-ladd-spake2 but it's quite
possible that I've missed something in all the recent emails.)

However, I don't agree that the algorithm is simply ignored. It's
clearly important to some that the generation algorithm be explicit
and transparent. Yes, it's odd that at the end we have to do an
arbitrary isogeny but I think the motivation for that is clear and
it's a "safe" step (i.e. we can't have hidden anything dodgy in there
to my knowledge.)

The algorithm could be written to reflect how curve25519 was
developed: i.e. that it output a Montgomery curve and then the twisted
Edwards is the obvious isomorphism from there (if needed). That might
well be clearer if we don't recommend any other curves.

But dealing with Edwards curves and having the algorithm generate them
makes it easier if we recommend another, or in the optimistic scenario
that we also end up specifying a signature scheme.

As far as making the wording clearer: lots of rewriting is called for
*if* this draft isn't dead-on-arrival.

(As an aside: does the existing algorithm output Curve41417,
Goldilocks or E-521 when given the corresponding prime? I suspect not
for Curve41417 since the curve/twist cofactors are {8,8} not {4,4}.
Goldilocks might work though.)

> Should cat be a coauthor?

If there's anyone I've left out, I'll add them immediately. And if
anyone wants to move from the "credit" section to the list of authors
I'll do that too. (The reason for not listing people as authors is in
section 1.)


Cheers

AGL