[Cfrg] Suggestions for draft-irtf-cfrg-curves-01.txt

["Stanislav V. Smyshlyaev" <[e-mail]>]

Dear colleagues,

We would like you to consider several proposals on the latest variant of
draft (draft-irtf-cfrg-curves-01).

1)      In our opinion, some important clarifications have to be done
explicitly in the document, though needed references are given.
  a) In Section 3.3 declare explicitly what "r” denotes.
  b) In Section 5 mention explicitly Schoof–Elkies–Atkin algorithm as an
algorithm used to calculate number of curve points or even fully cite it
there.
  c) Add explicit description of algorithms used to examine curve on MOV-,
CM- and twist-security as well as Frobenius trace calculation formula. Add
“perform checks” step in algorithms proposed in sections 5.1 and 5.2.
2)      Select and add a higher security curve (512- or 521-bit).
3)      Add some explanations on parameter d of the selected 255-bit curve
(the current draft leaves the question whether it is the first d to be
returned by 5.2 algorithm and the reason of choice if it is not).
4)      Introduce a rigid base point generation algorithm (either the one
that was proposed in the previous version of the draft or one using
cryptographic hash function). We consider that important to ensure the
generated points could be safely used in applied protocols like
password-based key establishment protocols (PAKE, EKE, PACE etc.) and RNGs
like Dual EC DRBG.


Best regards,
Stanislav V. Smyshlyaev, Ph.D.,
Head of Information Security Department,
CryptoPro LLC