Re: [Cfrg] generic curves ... RE: big-endian short-Weierstrass please

On Mon, Feb 2, 2015 at 2:29 PM, Kurt Roeckx <kurt@roeckx.be> wrote:
> On Thu, Jan 29, 2015 at 10:09:18PM +0000, Dan Brown wrote:
>> New thread name ... should have done so earlier.
>>
>> When TLS asked CFRG for new curves, I didn't interpret that to mean that
>> generic curves would be banned. Banishing generic curves adds slightly more
>> weight to the TLS request, because users cannot easily opt out of the chosen
>> few elite curves.
>
> If it's unclear what the TLS WG wants exactly, maybe it's best to
> ask them?
>
> My understanding is that they want fixed named curves.

Let me get this right:

There are no security concerns with Curve25519.

For the entire 12 months we've been piddling away, we could have
written Curve25519 in Weierstrass form, and the TLS specification
would already have included it as an option.

We've still got signatures and the choice of primes at higher security
levels to worry about, with about 10 emails total on these topics.

Instead we've spent 90+ emails debating whether an opaque byte vector
should be big or little endian, after the TLS WG already had this
debate.

We've exceeded a previously announced deadline by a month. We're still
picking editors for a draft that has a hard deadline coming up in
March (several hard deadlines), despite dropping several deliverables
to make it, and knowing that X25519 is going to be what is in the
eventual RFC.

When should we expect last call on a draft that describes Curve25519?

Sincerely,
Watson Ladd

>
>
> Kurt
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin