Re: [Cfrg] generic curves ... RE: big-endian short-Weierstrass please

["Paterson, Kenny" <[e-mail]>]

Dear Watson,

On 03/02/2015 16:50, "Watson Ladd" <[e-mail]> wrote:

>On Mon, Feb 2, 2015 at 2:29 PM, Kurt Roeckx <[e-mail]> wrote:
>> On Thu, Jan 29, 2015 at 10:09:18PM +0000, Dan Brown wrote:
>>> New thread name ... should have done so earlier.
>>>
>>> When TLS asked CFRG for new curves, I didn't interpret that to mean
>>>that
>>> generic curves would be banned. Banishing generic curves adds slightly
>>>more
>>> weight to the TLS request, because users cannot easily opt out of the
>>>chosen
>>> few elite curves.
>>
>> If it's unclear what the TLS WG wants exactly, maybe it's best to
>> ask them?
>>
>> My understanding is that they want fixed named curves.
>
>Let me get this right:
>
>There are no security concerns with Curve25519.

That is the consensus.

>
>For the entire 12 months we've been piddling away, we could have
>written Curve25519 in Weierstrass form, and the TLS specification
>would already have included it as an option.

It could, but then we would not have delivered what we were asked to
deliver by TLS WG. That was: to recommend curve or curves (and by
implication, algorithms using those curves) at a variety of security
levels. That required a more considered evaluation of the broader space,
not a single recommendation on Curve25519.

>
>We've still got signatures and the choice of primes at higher security
>levels to worry about, with about 10 emails total on these topics.

If you take the total discussion we've had over the last 9 months, then
there's significantly more than 10 e-mails. I think this has established a
pretty good understanding in the RG around the key issues. Making progress
should not require rehashing all of that (please!).

>
>Instead we've spent 90+ emails debating whether an opaque byte vector
>should be big or little endian, after the TLS WG already had this
>debate.

Did you count how many of those 90+ e-mails you sent yourself? On a blog
post elsewhere [1], you describe CFRG as being "more dysfunctional than
usual". I suggest it's incumbent on you to reflect carefully on the
reasons why that might be....

>We've exceeded a previously announced deadline by a month. We're still
>picking editors for a draft that has a hard deadline coming up in
>March (several hard deadlines),

The editors are in place. The chairs needed some time to appoint the
editors because of the initial document from Adam essentially being a
merge of other authors' documents.

>despite dropping several deliverables
>to make it, and knowing that X25519 is going to be what is in the
>eventual RFC.

It's not. It's going to be part of it, but we need more than X25519 to
meet the request from the TLS WG.

Right now, Alexey is out of action, but as soon as he is back, the chairs
will be moving the technical discussion forward and seeking consensus on
the key issues that still face us before we can deliver to TLS WG.

More soon.

Regards

Kenny 

[1] http://automorphy.blogspot.co.uk/?m=1