Re: [Cfrg] Curve selection revisited

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Jul 31, 2014 at 1:18 PM, Salz, Rich <[e-mail]> wrote:
>> I would like to see us use of the same curve for digital signature and key
>> agreement.  This provides obvious modularity, and it seems to fit well with
>> the security protocols that already have support for ECC.
>
> I don't want this requirement because I'd like to use 25519 for DH-style key exchange, without having to give up whatever "standard" curves are being used for signature.  I find the "system" approach to Curve25519 appealing, and the efficiency -- where we might have 100's of hosts on a single IP address with their own PFS requirements -- compelling.

I don't see that there is a need for a WF128 digital signature scheme
that is backwards compatible.

For existing uses of Digital Signatures where I am currently using
RSA2048 I will switch to WF256 curves and those are the ones where
backwards compatibility matters. There isn't a security argument to
switch from RSA2048 to curve25519 and I don't see the performance
argument as being a good one for where we are already using crypto.

It does make sense to do digital signatures for a WF128 curve because
there may well be applications that a higher performance curve will
enable.