Re: [Cfrg] Requirements for curve candidate evaluation update

I certainly don't agree that we need to be hamstrung by compatibility 
with existing HSM.  Clearly, the existing HSMs will work with NIST P-256.

Let's look at the risks of P-256 on an existing HSM.  The only real 
concern is that the NSA might know a vulnerability. For many users, this 
is not the end of the world.

I would not be surprised if many of the organizations with HSMs are 
financial institutions or government agencies.  These organizations are 
likely also constrained to FIPS 140-2 validated devices.  This means 
they can't escape  FIPS-approved curves, i.e. NIST P-256, etc.  And that 
means that even if we restricted ourselves to short Weierstrass curves, 
these HSM users still wouldn't be able to use their HSMs.

Finally, there is the assumption that the manufacturer of the HSM can't 
or won't upgrade the firmware.  That could be a business decision by the 
HSM manufacturer, but I doubt it is a technical one.  In a past life I 
worked for a company that built HSMs, and those could have their 
firmware updated.  Admittedly there is some possibility that the 
upgraded HSM will be slower, depending on how much of any special silcon 
can be harnessed for the new curve.

    --David Jacobson

On 8/13/14 4:48 PM, Phillip Hallam-Baker wrote:
> I really could care less about wire formats. They are completely
> mutable at this point.
>
> The only place where I have real legacy problems is in HSM support.
> Long term signature keys have to be generated and stored in HSMs. And
> no, that is not a 'nice to have feature', it is a 'be prepared to be
> laughed at and told that you completely wasted your time' if it isn't
> met type of feature.
>
> I don't need to be able to use my existing HSMs but if the curves
> chosen are not supported by any existing hardware and it takes 3 years
> for it to become available then its going to delay everything (apart
> from EDH).
>
>
>
>
>
>
> On Tue, Aug 12, 2014 at 6:05 PM, Salz, Rich <rsalz@akamai.com> wrote:
>> I have asked before, perhaps you missed it.
>>
>>
>>
>> I take exception to your claims that “single curve model” and “no change to
>> wire formats” are facts on the ground.  Can you justify that?
>>
>>
>>
>> --
>>
>> Principal Security Engineer
>>
>> Akamai Technologies, Cambridge MA
>>
>> IM: rsalz@jabber.me Twitter: RichSalz
>>
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> http://www.irtf.org/mailman/listinfo/cfrg
>>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg