Re: [Cfrg] big-endian short-Weierstrass please

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

>> That seems irrelevant. Some people will never be convinced of some things
>> that most other people agree to.
> 
> What is being argued against here is making room for DIY curves.
> 
> My point is that the only way to come up with an informed decision to use
> someone else's curves is to apply a vast amount of domain specific expertise
> plus really trust the supplier to not have something up their sleeves.

Unless that “somebody else” is your boss, or somebody you have informed
reasons to trust.

Some people (and organizations :) tend to trust “their” experts, and not
trust “other” experts as much. As an example – why didn’t NSA adopt Russian
GOST, and why didn’t Russians adopt AES? Probably not because they question
the competence of the other side? :-)

I’m arguing that there is a need for DIY curves, on both personal and
“organizational” level.

> So I think we can come up with a decision here but the process makes me
> certain that there is no possibility that two random computers could negotiate
> a secure set of curves on the Internet via a protocol. Unless that is we
> assume some form of out-of-band trust relationship.

There should be a set of “universally” accepted curves, so that when you
want to talk to a complete stranger – both of you would use what the
“community” considers cryptographically OK (which belongs to that small
commonly shared set). But that’s only half of use cases.

There should be an option to specify “my own” curves, so that when, e.g. one
“team" member wants to talk to his peer – their software will pick that
special curve that was for whatever reasons approved by their boss, or
refuse to connect. Because in that context ability to establish a connection
with a stranger is underisable.


> My view is that we should pick Curve 25519 because it is a decent balance of
> expediency and security for the performance curve and P512 because it removes
> virtually all possibility of 'up their sleevesies' argument for the highest
> assurance curve…..
> That said, I prefer the Edwards curves because I can explain them to other
> folk without resorting to abstract math (now I have been given the link to
> DJB's presentation at Chaos). The use of The Wierstrass forms are much less
> friendly.

I see your point.