[Cfrg] FIPS or equivalent approvals

[Phillip Hallam-Baker <[e-mail]>]

Choosing a curve is not all that we are going to need to make ECC crypto happen.

If we are going to use the new curves in PKIX (a major part of TLS) we
are going to need trustworthy HSMs. Which in turn means that we are
going to need some standard for approvals to be audited against and
possibly someone to run the process.


This might well mean that it is impractical to move away from some
form of DSA for signatures or at the very least mean that there is a
penalty for doing so. This is not likely to be as urgent a concern for
encryption as that is only an end entity issue and only a tiny
proportion of end entity applications require approved HSMs and those
that do are likely to require the NIST curves anyway.


So one consequence of this is that it would probably be advantageous
to the hardware vendors if they started taking notice of the
discussions as they are likely to see demand for new HSMs in the near
future.

Getting their participation and input would probably be useful to all concerned.