[Cfrg] Adoption request: draft-hdevalence-cfrg-ristretto

["Filippo Valsorda" <[e-mail]>]

Hello,

I'd like to request for the group to adopt
draft-hdevalence-cfrg-ristretto for publication as an Informational RFC.

https://datatracker.ietf.org/doc/draft-hdevalence-cfrg-ristretto/

Ristretto255 is a prime-order group designed by Henry de Valence,
based on Mike Hamburg's Decaf. It provides a safe, efficient, and
implementor-friendly abstraction for a prime-order group, enabling safer
and simpler design of higher-level protocols. Its order is the same as
the prime-order subgroup of Curve25519.

Ristretto255 can easily be implemented on top of an existing Curve25519
library, and the authors are providing multiple implementations in
different languages: curve25519-dalek in Rust, by Isis Lovecruft
and Henry de Valence; curve25519-elisabeth in Java, by Jack Grigg;
ristretto255 in Go (implemented clean-room from the spec),
by George Tankersley and myself; and ristretto-donna (forthcoming) in
C, by Isis Lovecruft. We are also aware of other implementations we
have not personally tested for interoperability, including one in Frank
Denis's libsodium.

https://github.com/dalek-cryptography/curve25519-dalek
https://github.com/cryptography-cafe/curve25519-elisabeth
https://github.com/gtank/ristretto255

Importantly, ristretto255 is a flexible abstraction, and can be
implemented with different, more efficient curves than Curve25519. The
draft only provides implementation details for a Curve25519 backend,
but it defines the interface contract which is required of compliant
implementations, allowing alternate backends.

The group has already been adopted by some higher level protocols,
including Bulletproofs by Chain, and has been subject of discussion on
this list, including some good posts by Tony Arcieri. More information
is available at https://ristretto.group and in the draft, and the
authors and I are available to answer questions.

Best, Filippo