Re: [Cfrg] [TLS] Unwarrented change to point formats

Watson,

There was certainly support for Curve25519 at the CFRG interim phone conference, from my reading of the transcript. 

I don't think the reasons for the TLS WG to ask for our input are nebulous, as you put it. I'd say they were taking a responsible approach, charging us as experts to explore the alternatives carefully and make recommendations. This choice will affect the future security of TLS for years - or decades - to come. So we have to get it right. 

That request to us does not mean anyone is ignoring existing drafts, as you write. I am also not aware of this IETF-wide requirement that you mention. I believe it's a "nice to have", but not a hard requirement. Can you point to something more solid that is demonstrably a consensus view?

You will note from my previous emails summarising the meeting in Toronto that backwards compatibility with the existing wire format is regarded as being desirable but not essential by the TLS WG leadership. If it can be done, it will make adoption easier; if not, we can change it, but it will need some careful drafting to make sure it's crystal clear. 

The fact that the small group who run OpenSSH has adopted a couple of schemes based on a particular curve does not necessarily make that curve the right choice for TLS. I also don't regard that as wide adoption, as you put it. I'm not aware of a public, requirements-driven process behind their choice. That's what we are attempting here.  

Your continued inputs to the process are most welcome. 

Regards

Kenny 

> On 26 Jul 2014, at 18:59, "Watson Ladd" <watsonbladd@gmail.com> wrote:
> 
> Dear all,
> Curve25519 was a draft. Curve25519 came back with good reviews from
> the CFRG. End of story? No: the TLS WG leadership has decided to ask
> for the choice of curves, on nebulous criteria, ignoring existing
> drafts, on the basis that the curves must be applicable "IETF wide".
> 
> I don't see the reason for this, especially given that OpenSSH has
> implemented and deployed Curve25519 and Ed25519, complete with
> Montgomery form on the wire.  Arguing that we need twisted Edwards
> point formats everywhere for consistency with existing libraries
> ignores what has already been deployed and widely adopted.
> 
> Sincerely,
> Watson Ladd
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 