Re: [Cfrg] My comments on TLS requirements from today's interim

[Andrey Jivsov <[e-mail]>]

On 07/01/2014 06:33 AM, Watson Ladd wrote:
>
> On Jul 1, 2014 6:17 AM, "Paul Hoffman" <[e-mail]
> <mailto:[e-mail]>> wrote:
>  >
>  > Trying to predict what NIST will do with FIPS-140 certification is
> silly. Even they don't know from year to year. The NIST of today is not
> the NIST of 14 months ago; it is likely that there will be other major
> shifts in NIST's view of itself and what it has to do to stay relevant.
>
> I had this concern at the CFRG meeting. Kevin Igoe said that the NSA had
> no objections to Curve 25519 being in Suite B.
>

This is a useful information. It would be even more useful if some 
statement of this sort was public and by NIST/NSA.

> There is a legacy cert and software problem: it's likely software will
> need to deploy several curves for compatibility with x509 certs.
>
> Finally, OpenSSL supports non FIPS algorithms as well as FIPS
> algorithms. It's not impossible to do the same.

I am not sure I see an argument here. OpenSSL had always many ECC curves 
but vendors were making sure to disable them at compile time. Only with 
great caution they would enable specifically P-256, and sometimes P-384, 
after careful consideration.

...