Re: [Cfrg] Proposed requirements for curve candidate evaluation

[Tanja Lange <[e-mail]>]

On Thu, Aug 07, 2014 at 11:57:45AM -0700, Michael Hamburg wrote:
> 
> > On Aug 7, 2014, at 7:20 AM, Brian LaMacchia <[e-mail]> wrote:
[..]
 
> > 4.	When evaluating candidate curves for use in ECDHE, "ephemeral" should be defined as "use exactly once in a key exchange" (or for TLS "use in exactly one handshake"). 
> > 
> > During the second TLS meeting in Toronto, Kenny Paterson gave a presentation summarizing where CFRG was on this question at that time and one of the points he mentioned was that there was not consensus as to what "ephemeral" should mean for purposes of evaluating candidates.  Russ Housley then commented at the microphone that "ephemeral" should mean "used in exactly one handshake".  I strongly concur with Russ's position and suggest that we formally adopt that definition now during the Requirements phase.  The concrete implication of adopting this proposed requirement is that it means when we evaluate ECDHE performance for curve candidates we must include one fixed-base and one variable-base operation. 
> 
> I agree that this is what “ephemeral” should mean for evaluation.  But I don’t understand how this clarification could possibly change anything.
>

I would like to clarify that we're talking about different kinds of 
evaluations:
a) For performance evaluations one can argue that ephemeral means
   one handshake (or a short time or a small number of connections).
b) For security evaluations we must take into account that users
   may keep reusing the same key; this must not be a problem for the
   security of the curve or the implementation.

	Tanja