Re: [Cfrg] tentative agenda for CFRG at IETF 89

[Robert Ransom <[e-mail]>]

On 2/27/14, David McGrew <[e-mail]> wrote:

> The TLS WG has asked for the CFRG opinion on ChaCha+Poly1305.    We also
> should be offering an opinion on the new ECC mechanisms.   Some
> questions for you: should we take on draft-ladd-safecurves-03 as an RG
> draft?

I strongly oppose adoption of draft-ladd-safecurves-03 as an RG draft or an RFC:

* In draft-ladd-safecurves-00, the ‘author’ merely copied a pile of
curve equations into an I-D and tried to pass it off as his own useful
contribution.  draft-ladd-safecurves-03 still takes a fundamentally
wrong approach in specifying several specific curves, when what is
needed is a document describing how the whole class of Montgomery and
Edwards curves is currently used and can be used in future
applications.

* It repeatedly claims to specify a ‘standard’ for ECC on those
curves; however, the draft is ‘Informational’, and it specifies point
formats for Curve25519 which are deliberately incompatible with the
existing standard practices among implementations.  Thus, it is
attempting to specify a new ‘standard’ in a non-standards-track
Internet document, in clear defiance of IETF policy.

* It contains several factual inaccuracies.

* It takes a condescending tone toward implementors, while omitting
critical details needed to apply what little information it provides
to other Montgomery and Edwards curves.

* None of the text of the draft explains any aspect of the use of
Montgomery and Edwards curves or any background information in a
useful level of detail.  It is not useful even as a starting point for
an RFC on this topic.

* The author has repeatedly disregarded advice from other RG members
regarding this draft, usually with unnecessary hostility.  I have not
yet seen any reason to believe that he will change his behaviour.  If
he is chosen as the editor of an RG document at this time, I will not
waste my effort on attempting to contribute to it.


I have nearly finished writing a relatively elementary exposition of
the background in abstract algebra and (Weierstrass-form) elliptic
curves needed to properly explain Montgomery and Edwards curves and
their use in cryptography.  I intend to send it to the CFRG mailing
list either tonight or tomorrow for review.  After that, the portion
of a document describing Montgomery and Edwards curves themselves (as
currently used) should be relatively easy.


> Should we recommend its adoption in TLS?

draft-ladd-safecurves is not needed in order to adopt Curve25519 for use in TLS.

Dr. Bernstein's Curve25519 paper specifies the existing standard for
scalar multiplication on Curve25519 in sufficient detail to serve as a
normative reference for RFCs specifying its use in ECDH in IETF
protocols.  I believe that Curve25519 should be recommended for
adoption in TLS, and that a future version of
draft-josefsson-tls-curve25519 (which addresses the comments made on
the TLS list regarding the (current) -04 version) will be suitable for
publication as an RFC.


Robert Ransom