Re: [Cfrg] [TLS] Unwarrented change to point formats

[Watson Ladd <[e-mail]>]

On Sun, Jul 27, 2014 at 2:37 PM, Eric Rescorla <[e-mail]> wrote:
> On Sun, Jul 27, 2014 at 1:39 PM, Watson Ladd <[e-mail]> wrote:
>>
>> On Sun, Jul 27, 2014 at 1:26 PM, Eric Rescorla <[e-mail]> wrote:
>
>
>>
>> > To take a specific set of cases. TLS has three major uses for public key
>> > crypto of this type:
>> >
>> > - Key establishment
>> > - Digital signatures over handshake messages (ServerKeyExchange,
>> >   CertificateVerify, etc.)
>> > - Digital signatures over certificates.
>> >
>> > It seems likely that key establishment shares common requirements for
>> > multiple protocols. Similarly, it would be quite convenient if the
>> > signatures
>> > used in TLS were the same as those used for the certificates used for
>> > TLS,
>> > even though the latter are not defined in TLS. So, when I say an
>> > IETF-wide
>> > set of recommendations that's the kind of thing I mean.
>> >
>> > I wasn't aware that any of this was particularly controversial.
>>
>> You had a draft in hand, got a reply that "yeah, looks good", and then
>> went back to ask for
>> a completely different design process, for reasons never discussed.
>> It's the second round
>> that's confusing me.
>
>
> This does not match my understanding of the history.
>
> Rather, here's my memory:
>
> 1. We asked the CFRG for a recommendation.
>
> 2. The CFRG held an interim discussion where a lot of good things
> were said about Curve25519 but the CFRG never made a recommendation
> to the TLS WG, but instead said it would come back and make
> a recommendation.
>
> 3. The TLS Chairs sent the CFRG chairs a written request to make
> such a recommendation (my memory is that they actually asked us
> to write something down, but I don't immediately see it in my mail.)
>
> Which brings us to the current process being run in CFRG.

And that's exactly the problem: instead of asking "is this proposed
curve secure" or "are the arguments in favor of
Curve25519 largely correct" you want CFRG to evaluate things it really
can't. How do we know if uptake in TLS will
be slowed by being non-Weierstrass?  How do we evaluate if
implementors want to implement Montgomery and
twisted Edwards arithmetic vs. just one?

I don't see why this couldn't have ended in March with "well, no
security concerns were identified, so Curve25519
will be in TLS".

Sincerely,
Watson Ladd

>
> -Ekr
>
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin