Re: [Cfrg] MAY use specified curves

On Tue, Sep 9, 2014 at 6:07 PM, David Leon Gil <coruus@gmail.com> wrote:
>
>
>> i'd say that custom groups or curves are at best a SHOULD NOT, unless
>> there are some very clear guidelines on how to evaluate them at
>> connection time to determine what approximate security level they provide.

There are a number of "attacks" on ECDSA where an existing signature
can be made to verify under a newly created key by using a custom
group. While these do not violate the security assumptions in the
standard signature model, they are occasionally annoying. Insofar as
we can trust servers not to be stupid, there isn't an issue with
custom curves in TLS, but sadly that is not the case.

Furthermore, no security benefit to using custom curves exists: the
batching attacks are of no consequence as getting even one discrete
log is hard. The only claimed security benefit is adapting to changes
in ECC security.

>
> To expand on this, I think that the CFRG should provide a method for
> evaluating curves for safety for IETF WGs to use.
>
> A number of people have mentioned applications with specific criteria that
> may not be satisfied by curves that are good for TLS. This matter is --
> unlike performance considerations, or cipher-equivalent-security-level
> minutiae -- very clearly in-scope for CFRG.

Which applications with which criteria? So far the only one has been
random primes for hardware, with an eye towards TLS and PKIX. If you
really want to know, look at safecurves.cr.yp.to. I don't see why we
should have dozens of curves, one for each protocol with a WG, further
complicating the work of implementers, and harming interoperability in
situations where only a few curves can be built in.

Your argument looks to me that CFRG should not recommend new curves,
and should say all the proposals are fine, and kick them back to the
TLS WG.

Sincerely,
Watson Ladd

>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
>

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin