[Cfrg] Alternatives to rigidity?

[Tony Arcieri <[e-mail]>]

It seems the purpose of proposed "rigid" curve generation guidelines is to
produce so-called "nothing up my sleeve" curves, i.e. curves we are
confident haven't been tampered with to reduce security because we assume
we can create an algorithm to pick good curves.

However it seems there are differing opinions on what constitutes rigidity,
e.g. the Ben Black draft vs:

http://safecurves.cr.yp.to/rigid.html

Instead of trying to come up with constraints to generate curves de novo,
why not judge curves on the merits of how they were generated and what
known properties they hold? The SafeCurves web site lays out a rubric for
doing this:

http://safecurves.cr.yp.to/

Surely people would want to bikeshed this rubric, but isn't it a good start?

It also seems like the most important thing is producing a performant safe
curve. Some promising ones seem to be:

- Curve25519
- Ed448-Goldilocks
- Ilari's 2^389-21 curve

There are certainly others, but the above seem to perform well.

My take is that the CFRG is otherwise deadlocked, and the central issue
seems to be the trustworthiness of curves. However, at least as far as I
can gather from the crypto community, Curve25519 is widely accepted and
nobody (except Microsoft?) is questioning that.

There are certainly other questions like a signature algorithm, but even
there I think EdDSA is widely accepted, and performs well too.

I guess my main question is: does anyone else care about rigidity (as
defined by Ben Black) except Microsoft and if not, should the CFRG just
punt on it and pick some curves everyone else considers non-controversial?

-- 
Tony Arcieri