Re: [Cfrg] big-endian short-Weierstrass please

[Phillip Hallam-Baker <[e-mail]>]

On Sun, Feb 1, 2015 at 2:32 AM, Andrey Jivsov <[e-mail]> wrote:

> On 01/29/2015 05:21 AM, Phillip Hallam-Baker wrote:
>
>> So by FIPS-140 equivalent, what is meant is something that we can get a
>> group of experts to agree is equivalent and safe. It probably means that
>> the hardware is certified FIPS-140 but not necessarily for the
>> particular algorithm. This may or may not require wording changes but I
>> don't expect they would be controversial.
>>
>
> Unless the new curve is accepted along the lines of P-256 by NIST, it will
> be treated no much differently than CAMELIA (or DES).
>
> Without this change, the new curve is a Non-Approved security function and
> it can only be used in non-Approved modes of operation. Crypto module
> documentation will need to make this clear, per FIPS 140-2.
>
> It's a known trick to certify only AES and then somehow make an impression
> that other algorithms are covered by the same module. NIST put multiple
> notes to make this harder. Thus, NIST will need to explicitly bless the new
> curve. A precedent for this is the TLS KDF.


It would be necessary if NIST made the rules for CAs, but they don't.

The question is whether NIST is going to stay relevant to its primary
function of supporting commerce or not.