Re: [Cfrg] Suggestions for draft-irtf-cfrg-curves-01.txt
Paul Lambert <paul@marvell.com> Mon, 02 February 2015 20:04 UTC
Return-Path: <paul@marvell.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68DE31A1A8C for <cfrg@ietfa.amsl.com>; Mon, 2 Feb 2015 12:04:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.267
X-Spam-Level:
X-Spam-Status: No, score=-2.267 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aFOuwbbywsxL for <cfrg@ietfa.amsl.com>; Mon, 2 Feb 2015 12:04:55 -0800 (PST)
Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BFBB1A19F4 for <cfrg@ietf.org>; Mon, 2 Feb 2015 12:04:55 -0800 (PST)
Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.14.5/8.14.5) with SMTP id t12JtUXS008091; Mon, 2 Feb 2015 12:04:52 -0800
Received: from sc-owa.marvell.com ([199.233.58.135]) by mx0b-0016f401.pphosted.com with ESMTP id 1s8vwrcr5a-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Mon, 02 Feb 2015 12:04:52 -0800
Received: from SC-vEXCH2.marvell.com ([10.93.76.134]) by SC-OWA.marvell.com ([::1]) with mapi; Mon, 2 Feb 2015 12:04:51 -0800
From: Paul Lambert <paul@marvell.com>
To: Watson Ladd <watsonbladd@gmail.com>, Evgeny Alekseev <eamsucmc@gmail.com>
Date: Mon, 02 Feb 2015 12:04:47 -0800
Thread-Topic: [Cfrg] Suggestions for draft-irtf-cfrg-curves-01.txt
Thread-Index: AdA/I4Ax0e50JSV7T56v4oXMNEU6pg==
Message-ID: <D0F51314.5A84F%paul@marvell.com>
References: <CAOVPyjxPUhF1mK9C3vEbM4ABxW0P46Wi7JxQSbFRF01i45WmQg@mail.gmail.com> <CACsn0cm2zktOjrqBXYfFLij_-C3vwmk7oDsqJwMvc4MxUa3oRA@mail.gmail.com>
In-Reply-To: <CACsn0cm2zktOjrqBXYfFLij_-C3vwmk7oDsqJwMvc4MxUa3oRA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/14.4.7.141117
acceptlanguage: en-US
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.13.68, 1.0.33, 0.0.0000 definitions=2015-02-02_04:2015-01-30, 2015-02-02, 1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1402240000 definitions=main-1502020194
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/lI2ScTXT3pqNSfqFkUE63zBDnec>
Cc: "cfrg@ietf.org" <cfrg@ietf.org>
Subject: Re: [Cfrg] Suggestions for draft-irtf-cfrg-curves-01.txt
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Feb 2015 20:04:57 -0000
On 2/2/15, 8:35 AM, "Watson Ladd" <watsonbladd@gmail.com> wrote: >On Mon, Feb 2, 2015 at 7:07 AM, Evgeny Alekseev <eamsucmc@gmail.com> >wrote: >> Stanislav V. Smyshlyaev wrote: >> >>> Dear colleagues, >>> >>> We would like you to consider several proposals on the latest variant >>>of >>> draft (draft-irtf-cfrg-curves-01). >>> >>> 1) In our opinion, some important clarifications have to be done >>> explicitly in the document, though needed references are given. >>> a) In Section 3.3 declare explicitly what "r² denotes. >>> b) In Section 5 mention explicitly SchoofElkiesAtkin algorithm as an >>> algorithm used to calculate number of curve points or even fully cite >>>it >>> there. >>> c) Add explicit description of algorithms used to examine curve on >>>MOV-, >>> CM- and twist-security as well as Frobenius trace calculation formula. >>>Add >>> ³perform checks² step in algorithms proposed in sections 5.1 and 5.2. >>> 2) Select and add a higher security curve (512- or 521-bit). >>> 3) Add some explanations on parameter d of the selected 255-bit >>>curve >>> (the current draft leaves the question whether it is the first d to be >>> returned by 5.2 algorithm and the reason of choice if it is not). >>> 4) Introduce a rigid base point generation algorithm (either the >>>one >>> that was proposed in the previous version of the draft or one using >>> cryptographic hash function). We consider that important to ensure the >>> generated points > could be safely used in applied protocols like >>> password-based key establishment protocols (PAKE, EKE, PACE etc.) and >>>RNGs >>> like Dual EC DRBG. >>> >>> >>> Best regards, >>> Stanislav V. Smyshlyaev, Ph.D., >>> Head of Information Security Department, >>> CryptoPro LLC >> >> >> I agree with Stanislav Smyshlyaev¹s questions and suggestions about >>current >> draft version. I would like to draw attention to the 3d remark. If the >> answer to this question ("... whether it is the first d to be returned >>by >> 5.2 algorithm ...") is ³no² then it turns out that extra requirements >>that >> are not mentioned in the draft are implicitly applied to the curve. >>Also it >> seems strange that the recommended curve is not the one with the >>smallest d, >> but the isogeny of this curve. Also I would like to add that it would be >> convenient if the recommended Edwards curve is included in the document >>in >> the same way as twisted Edwards curve. +1 > >The recommended curve is y^2=x^3+486662x^2+x. Were we to use an >isomorphic curve, as opposed to a 4-isogenous one, that 486662 would >be replaced by a larger number, and thus slow down implementations >significantly. Note that 486662 is the smallest value of a that >ensures that >y^2=x^3+ax^2+x has order 8*prime, twist order 4*prime, and the usual >CM restrictions. This is the same as 121665 being the smallest d that >ensure that y^2+x^2=1+dx^2y^2 has the same order and CM restrictions. So Š the designated editing team will process the above answer and create suitable text for possible inclusion into the draft specification. Yes? Paul > >Sincerely, >Watson Ladd > >> >> Kind regards, Evgeny Alekseev, Doctor of Philosophy, >> Moscow State University, Faculty of Computational Mathematics and >> Cybernetics >> >> >> >> _______________________________________________ >> Cfrg mailing list >> Cfrg@irtf.org >> http://www.irtf.org/mailman/listinfo/cfrg >> > > > >-- >"Those who would give up Essential Liberty to purchase a little >Temporary Safety deserve neither Liberty nor Safety." >-- Benjamin Franklin > >_______________________________________________ >Cfrg mailing list >Cfrg@irtf.org >http://www.irtf.org/mailman/listinfo/cfrg
- [Cfrg] Suggestions for draft-irtf-cfrg-curves-01.… Stanislav V. Smyshlyaev
- Re: [Cfrg] Suggestions for draft-irtf-cfrg-curves… Evgeny Alekseev
- Re: [Cfrg] Suggestions for draft-irtf-cfrg-curves… Watson Ladd
- Re: [Cfrg] Suggestions for draft-irtf-cfrg-curves… Paul Lambert
- Re: [Cfrg] Suggestions for draft-irtf-cfrg-curves… Evgeny Alekseev