Re: [Cfrg] Summary

On Thu, Jan 1, 2015 at 9:49 AM, Kurt Roeckx <kurt@roeckx.be> wrote:
> Hi,
>
> I'm new to this list and I've been reading the archive.  It's all
> very unclear to me on what is really going on.  Could someone
> please make a summary?  It should probably include:
> - What are the things being worked on?  I understand that at least
>   part is recommending things for use in TLS, but I guess there
>   are also other things being worked on.

The curves issue is really the big one, and the drastically overdue
one. I would suggest not trying to follow the discussion through the
archive.

> - What are the various proposals?  The IETF datatracker doesn't
>   seem to known all proposals, and I think there are proposals
>   that just don't have a document yet.

Good question: the answer is that at the 255 bit level, for ECDH the
current proposals are both Curve25519. But one uses the same basepoint
as existing code, and the other doesn't. This difference doesn't
affect security in any way. It's the only difference.

Above 255 bits, life gets more interesting. Assuming we want to use
X-coordinate Montgomery (sorry Mike) for ECDH and compressed Edwards
for sigs, we've got 3 or 4 different proposals for around 380, and 1
for 521.

-For 521 it's E521 as described on safecurves.cr.yp.to, the prime being 2^521-1
-2^389-21: I've not calculated the curve yet, but I think Ilari may have
-2^384-317: the NUMS proposal
-2^448-2^224-1: Goldilocks, which has extremely fast arithmetic due to
its shape.

We don't have exactly equivalent numbers for each of these: some
report scalar mult times, others arith times. But what we do know from
the recent batch of measurements is Goldilocks is about as fast as
2^384-17, and 2^389-21 is 8-9% faster than Goldilocks. 2^521-1 is
slower, but much bigger.

For signatures, NUMS proposes what I've called FrankenECDSA, and they
call ECDSA (but isn't really): doing ECDSA but with Edwards curves.
The other proposal is EdDSA, which is a Schnorr signature variant.
NUMS has been open to an additional signature algorithm, and we can
use ECDSA on an isomorphic Weierstrass curve if we really want. There
are some differences over which of the isogenous or isomorphic Edwards
curve to use, with NUMS using an isogenous one and the current Ed25519
an isomorphic one.

This is very different from the original NUMS proposal.

> - Is there some document with requirements, and maybe a comparison
>   of how the proposals meet the requirements?

No. The chairs suggested making one, but then didn't. Part of the
problem is everyone was gaming the requirements to make their own
proposals look better.

Sincerely,
Watson Ladd

>
>
> Kurt
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin