Re: [Cfrg] Fwd: I-D Action: draft-turner-thecurve25519function-00.txt

[Paul Lambert <[e-mail]>]

On Wed, Jul 30, 2014 at 11:16 AM, Phillip Hallam-Baker <[e-mail]<mailto:[e-mail]>> wrote:
On Wed, Jul 30, 2014 at 2:05 PM, Randy Bush <[e-mail]<mailto:[e-mail]>> wrote:
> sean, we also need signatures.  would you consider adding ed25519 to
> this draft or doing a parallel draft?
+1

We do need signatures, but do we need curve 25519 signatures?


Using the same curve across kx and signatures simplifies specification, implementation, and deployment.
Yes!


RSA allows one key to be used for encryption and signature easily. But
that is still terrible security practice.
Not always.  First, using the same curve could be with different keys.
Option should also be allowed to have same key support key establishment
and signatures.  There are improvements in protocol design/usability that are possible.

Paul




I don't see how this is relevant to using the same curves in different algorithms.

Looking through the sets of requirements we have, a curve optimized
for encryption may not be best for signatures. And writing up how to
do signatures from a curve is non-trivial (unless its 'do DSA with
this curve')


Specific to Randy's request, EdDSA is specified in the same paper as ed25519.

Given that the EC keys are short, we could have a combined 'encryption
and signature' certificate  but with different curves for each one.


The discussion is about using the same curves in different algorithms. Curves are not keys.


b