Re: [Cfrg] tentative agenda for CFRG at IETF 89

[Robert Ransom <[e-mail]>]

On 2/28/14, David McGrew <[e-mail]> wrote:

>> I have nearly finished writing a relatively elementary exposition of
>> the background in abstract algebra and (Weierstrass-form) elliptic
>> curves needed to properly explain Montgomery and Edwards curves and
>> their use in cryptography.  I intend to send it to the CFRG mailing
>> list either tonight or tomorrow for review.  After that, the portion
>> of a document describing Montgomery and Edwards curves themselves (as
>> currently used) should be relatively easy.
>
> Thanks for the offer to contribute here.

I've sent that document to the list now (attached to ‘Review of ECC topics’).


>>> Should we recommend its adoption in TLS?
>> draft-ladd-safecurves is not needed in order to adopt Curve25519 for use
>> in TLS.
>>
>> Dr. Bernstein's Curve25519 paper specifies the existing standard for
>> scalar multiplication on Curve25519 in sufficient detail to serve as a
>> normative reference for RFCs specifying its use in ECDH in IETF
>> protocols.  I believe that Curve25519 should be recommended for
>> adoption in TLS, and that a future version of
>> draft-josefsson-tls-curve25519 (which addresses the comments made on
>> the TLS list regarding the (current) -04 version) will be suitable for
>> publication as an RFC.
>
> I am wary of relying on the curve25519 paper as a normative reference.
> Perhaps your goal here is to provide an informational document (the
> draft that you mention above) that offers implementation guidance,
> instead of a normative reference?

RFC 4492 (ECC ciphersuites for TLS) cites ANSI X9.62, IEEE 1363, and a
few documents labeled as ‘standards’ by the corporations which
authored them as normative references.  It cannot be implemented
without the information in ANSI X9.62 and IEEE 1363.  ANSI X9.62 is
available from ANSI for 100 USD; IEEE 1363 is available from ANSI for
168 USD.

It is true that the author of the Curve25519 paper is neither a large
corporation nor an organization with “Standards” in its name, and did
not label Curve25519 as a ‘standard’ in the paper's title.  However,
the Curve25519 scalar multiplication function specified in the paper
became a ‘standard’, in the sense which IETF claims to use the word,
when software developers came to the rough consensus that it was a
good cryptographic primitive to use, and wrote and deployed running
code which implements it.  The Curve25519 paper is available for free
from the URL <http://cr.yp.to/ecdh/curve25519-20060209.pdf>.

What is your objection to using the Curve25519 paper as a normative
reference for the standard Curve25519 scalar multiplication function?


Robert Ransom