Re: [Cfrg] Suggestions for draft-irtf-cfrg-curves-01.txt

[Evgeny Alekseev <[e-mail]>]

Stanislav V. Smyshlyaev wrote:

> Dear colleagues,
>
> We would like you to consider several proposals on the latest variant of
draft (draft-irtf-cfrg-curves-01).
>
> 1)      In our opinion, some important clarifications have to be done
explicitly in the document, though needed references are given.
>  a) In Section 3.3 declare explicitly what "r” denotes.
>  b) In Section 5 mention explicitly Schoof–Elkies–Atkin algorithm as an
algorithm used to calculate number of curve points or even fully cite it
there.
>  c) Add explicit description of algorithms used to examine curve on MOV-,
CM- and twist-security as well as Frobenius trace calculation formula. Add
“perform checks” step in algorithms proposed in sections 5.1 and 5.2.
> 2)      Select and add a higher security curve (512- or 521-bit).
> 3)      Add some explanations on parameter d of the selected 255-bit
curve (the current draft leaves the question whether it is the first d to
be returned by 5.2 algorithm and the reason of choice if it is not).
> 4)      Introduce a rigid base point generation algorithm (either the one
that was proposed in the previous version of the draft or one using
cryptographic hash function). We consider that important to ensure the
generated points > could be safely used in applied protocols like
password-based key establishment protocols (PAKE, EKE, PACE etc.) and RNGs
like Dual EC DRBG.
>
>
> Best regards,
> Stanislav V. Smyshlyaev, Ph.D.,
> Head of Information Security Department,
> CryptoPro LLC


I agree with Stanislav Smyshlyaev’s questions and suggestions about current
draft version. I would like to draw attention to the 3d remark. If the
answer to this question ("... whether it is the first d to be returned by
5.2 algorithm ...") is “no” then it turns out that extra requirements that
are not mentioned in the draft are implicitly applied to the curve. Also it
seems strange that the recommended curve is not the one with the smallest
d, but the isogeny of this curve. Also I would like to add that it would be
convenient if the recommended Edwards curve is included in the document in
the same way as twisted Edwards curve.

Kind regards, Evgeny Alekseev, Doctor of Philosophy,
Moscow State University, Faculty of Computational Mathematics and
Cybernetics