Re: [Cfrg] Proposed requirements for curve candidate evaluation

[Andrey Jivsov <[e-mail]>]

On 08/07/2014 07:20 AM, Brian LaMacchia wrote:
> 4.	When evaluating candidate curves for use in ECDHE, "ephemeral" should be defined as "use exactly once in a key exchange" (or for TLS "use in exactly one handshake").
>
> During the second TLS meeting in Toronto, Kenny Paterson gave a presentation summarizing where CFRG was on this question at that time and one of the points he mentioned was that there was not consensus as to what "ephemeral" should mean for purposes of evaluating candidates.  Russ Housley then commented at the microphone that "ephemeral" should mean "used in exactly one handshake".  I strongly concur with Russ's position and suggest that we formally adopt that definition now during the Requirements phase.  The concrete implication of adopting this proposed requirement is that it means when we evaluate ECDHE performance for curve candidates we must include one fixed-base and one variable-base operation.

IMO I would prefer to see the actual numbers, i.e. the break-down of 
performance measurements instead of assuming some "package" of a likely 
usage pattern or combination of fixed-based+variable-based operations.

There is always one variable-base operation (time A).

In addition, there is either of these:
* a fixed-based operation or (a textbook case, time B)
* a fixed based operation plus the precomputation time attributed to the 
fixed base optimization (a short-lived context case, time B+P)
* an (un-optimized) fixed-based operation that uses the same code as 
variable-based operation (a small-footprint case, time A)
* reuse (time ~0)
( + There are other middle-of the road cases... )

A is the most important metric. B<A; the ratio B/A is needed to 
evaluate if the extra implementation effort and complexity is worth it. 
P is penalty and is important in some cases.