Re: [Cfrg] Summary

[Watson Ladd <[e-mail]>]

On Thu, Jan 1, 2015 at 2:03 PM, Kurt Roeckx <[e-mail]> wrote:
> On Thu, Jan 01, 2015 at 10:50:49AM -0500, Watson Ladd wrote:
>> > - Is there some document with requirements, and maybe a comparison
>> >   of how the proposals meet the requirements?
>>
>> No. The chairs suggested making one, but then didn't. Part of the
>> problem is everyone was gaming the requirements to make their own
>> proposals look better.
>
> I think it could be useful to have such a list.  Please note that
> not all the requirements are of equal importance, some might be a
> MUST and others might be nice to have.  The importance might also
> change depending on the use, like TLS, SSH, PGP or X509.  Maybe
> we can't agree on those levels, but I think a list a list could
> be useful.

We tried that exercise. The problem is that all these protocols use
only two things: signatures and ECDH (okay, ECIES, but that's ECDH+an
AEAD mode), and use separate keys for each. Even if they didn't, this
wouldn't in any way lead to a restriction on which primes to use, and
certainly wouldn't solve the problem of which generator to use.

If you go beyond this to consider implementations, then it turns out
that people actually want to change their implementations and
protocols to take advantage of better cryptography. The original NUMS
proposal had a rather ugly way to stuff the results in existing point
formats, but I don't remember much implementor enthusiasm for doing
that, and TLS 1.3 is being redesigned to accommodate non-Weierstrass
curves. (Why they need to wait for us, I can't remember: perfectly
possible to say "bytes go here") Brainpool wanted to use random primes
because of the details of their smartcards, but their claims that this
was necessary for side-channel security were wrong: extra performance
lets you do more blinding. Certainly now with NUMS being changed to
use the same formats as the alternative proposal, it's a moot point.

Had we dinged the NUMS proposal for the reasons it eventually was
modified, then yes, we would have solved a good deal of our problems.
But the current bikeshedding wasn't the issue we were originally faced
with, which were two or three rather different proposals. There's a
temptation, which I've indulged in, to think of ways we could have
done things differently: most crypto competitions don't have these
issues, for instance. But it's not really helpful with where we stand
now.

Sincerely,
Watson Ladd

>
>
> Kurt
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin