Re: [Cfrg] (SPAM) Re: FourQ draft now available

[Hanno Böck <[e-mail]>]

On Fri, 23 Sep 2016 14:11:00 +0000
Erwann Abalea <[e-mail]> wrote:

> Maybe that doesn’t count as a « major protocol », or even as an
> Internet use, but I see a potential benefit in the C-ITS domain
> (Cooperative Intelligent Transport Systems), where cars and
> infrastructure broadcast signed messages up to 10 times per second,
> maybe more frequently in some specific use-cases. With a 300m
> reception range in urban areas, that’s a lot of signed messages to
> check each second, with safety concerns. Current standards (IEEE 1609
> and ETSI ITS) use ECDSA under NIST-P256 curve, some are pushing for
> Brainpool (guess who?), a few people would like to see something new
> but see resistance. In the corresponding working groups, cryptography
> is often seen as very costly (bandwidth, CPU, hardware, …), it’s good
> to see progress in some of these costs.

I don't see this as a very convincing case. First of all this strikes
me as a "this may be useful for X" argument, highly speculative and
very different from a "we want to use this in X once it's standardized".

If they currently use P256 and consider switching to brainpool then
probably performance isn't their biggest concern, because it's well
known that the brainpool curves are amongst the slowest options. (I
have some guesses why brainpool is considered, but that has probably
more to do with nationalism than with technology arguments.) I also
wonder if the people who see cryptography as costly base their opinion
on real numbers or just myths (I see this a lot in the TLS space where
people often have unrealistically high ideas about the performance
costs).

Given that my trust in these industries to implement cryptography in a
careful way is limited I'd consider giving them a safer option (aka
curve25519) is probably smarter than giving them one that has
implementation pitfalls.


-- 
Hanno Böck
https://hboeck.de/

mail/jabber: [e-mail]
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42