Re: [Cfrg] My comments on TLS requirements from today's interim

[Yoav Nir <[e-mail]>]

On Jul 1, 2014, at 7:24 PM, Andrey Jivsov <[e-mail]> wrote:

> On 07/01/2014 06:16 AM, Paul Hoffman wrote:
>> Trying to predict what NIST will do with FIPS-140 certification is silly. Even they don't know from year to year. The NIST of today is not the NIST of 14 months ago; it is likely that there will be other major shifts in NIST's view of itself and what it has to do to stay relevant.
> 
> You might be surprised that there many product managers building secure products today who never heard of Curve25519 and think that it is silly to even consider any crypto outside of NIST.

It certainly makes sense for anyone who plans on selling anything to US government agencies or state and local government bodies in the US. They will have the NIST algorithms. So there’s AES and SHA-whatever, and P-256. 

But look at browsers. The four most popular are made by US-based companies. And yet they all support non-NIST-approved algorithms in TLS, in addition to NIST-approved algorithms. Currently not EC curves, but at least the people who work for these vendors and participate here and on the TLS list are among those interested. 

IPsec is somewhat less diverse, but there’s plenty of CAST and Camellia and IDEA and Blowfish and MD5 and Tiger there as well. There’s Camellia at least in SSH as well.

If Curve-25519 allowed me to publish a higher figure for “Main Modes per second”, or “full TLS handshakes per second”, I would implement it without thinking twice, making sure to disable it in the special “FIPS mode”.

Yoav