Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API

[Dan Brown <[e-mail]>]

> -----Original Message-----
> From: Cfrg [mailto:[e-mail]] On Behalf Of Harry Halpin
> 
> We'll just watch the discussions on the preliminary version come in and
revise
> within a week or two unless there is serious disagreement between members
> of CFRG. If theres is more or less agreement, I'll make the edits and then
> formally submit this to be a CFRG edited draft.
> 

I disagree with the "NO" for ECDSA for future use..  The larger reason is
that only alternative signature algorithms in the document are RSA-based,
whereas, by contrast, TLS is moving from RSA to ECC.  The smaller reason is
that ECDSA seems, to me, quite secure for future use if used properly.

I disagree with the rationale against ECDSA about the "weakness" of the
provable security results. Here, I may be biased, being an author of such
works.  

I disagree with the claims regarding Vaudenay's domain parameter attack.
For prime fields: first, as Vaudenay himself writes, the attack is not known
to be effective in the case of prime fields; second, CFRG is now undertaking
a recommendation for new curves.  For binary fields: first, they are being
used much less; second, the usual representations are chosen from a rather
"rigid" list, rather than an arbitrary list as described in the attack.
Specifically, SEC1 defaults a unique representation per field, using
trinomial if possible, else pentanomial, with degrees of the middle terms of
minimized.  For conveying elliptic curve parameters using ASN.1, usually one
just uses an OID which requires the default representation, or alternatively
one can specify the curve details which requires a normal basis, a
trinomial, or a pentanomial.  It seems that ANSI X9.62-2005 now has similar
requirements for the field representations.  Therefore, I think the claim
that the field representation can be chosen maliciously is inconsistent with
the SECG and ANSI standards.

I can elaborate and discuss the points above further, if needed. I believe
that CFRG now has a focus on recommending a new elliptic curve, so I have
tried to be brief here.