Re: [Cfrg] big-endian short-Weierstrass please

On Jan 29, 2015 9:36 AM, "Phillip Hallam-Baker" <phill@hallambaker.com>
wrote:
>
>
>
> On Thu, Jan 29, 2015 at 11:30 AM, Daniel Kahn Gillmor <
dkg@fifthhorseman.net> wrote:
>>
>> On Wed 2015-01-28 18:38:49 -0500, Blumenthal, Uri - 0558 - MITLL wrote:
>> > The problem is - reasonably-vetted by who? NIST? DJB? Yourself? All of
the
>> > above?
>>
>> If this lengthy process we're involved in doesn't turn out to be
>> reasonable vetting by a multistakeholder group, i'll be sorely
>> disappointed.
>>
>> > Attractiveness of the ability to select a custom curve is similar to
that
>> > of PGP Web of Trust: you can make a choice for yourself, rather than
being
>> > forced into what other experts (or “experts” :) decide for you.
>>
>> This is different from the PGP Web of Trust.  If i'm communicating with
>> a new peer using TLS, and they want to use MagicCurveX that i've never
>> seen before, my TLS client is not going to be able to evaluate it
>> properly, certainly not before the TLS handshake expires.
>
>
> +1
>
> Deploying and implementing cryptosystems requires an enormous amount of
expertise and they can fail in many different ways of which a flaw in the
cryptographic algorithm security is very very rare.
>
> We are not using the web of trust model to develop code so why on earth
try to apply it to choice of algorithm?
>
> The reason for applying web of trust is when there is no good
alternative. I have written papers recently where I show how we might make
the web of trust tractable and practical but that is because validating
credentials for six billion people is a very different problem.
>
>
>>
>> Anyone can of course decide what curves are worth using, and can apply
>> their own analysis with their peers to come to that decision.  But if
>> you're communicating with the arbitrary outside world, there needs to be
>> some broader consensus about which curves to commonly use.
>
>
> More importantly, I can't use your curves unless you can prove to me that
they are secure. And the fact we are having trouble doing that in this
group proves that it is not possible to achieve that in a protocol.

We are not having trouble with that  in this group. Nobody disputes that
any of the proposed curves are secure, or the details of generation.

Instead, we're arguing about endiannes. I've tried to gather which primes
everyone wants in one list, crickets.  Tony Arceli posts about signatures,
5 messages. Big v. Little, 40.

Of course a malicious party can leak whatever you send them.

Sincerely,
Watson Ladd
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
>