Re: [Cfrg] Adoption of draft-agl-cfrgcurve-00 as a RG document

[Andrey Jivsov <[e-mail]>]

On 01/08/2015 01:51 PM, Watson Ladd wrote:
> Three points:
>
> 1: There are recurring security issues caused by not sending
> compressed points, as well as additional complexity
> 2: We're not talking about signatures in this draft.
> 3: Options are bad.

Regarding options, this draft is a foundational document of a low-level 
crypto primitive. Protocols above can still pick a single wire format.

The spec should allow, for example, S/MIME to select (x) for space 
saving, while TLS to select (x,y) for performance. (I am not making 
these choices here).

The entire document is an optional primitive. SuiteB and Brainpool 
curves will be around for awhile.

One might say that the proposed tweak retains a single format, which is 
(x,y), with an available (internal) optimization to use x with a 
Montgomery ladder.


Re: security issues, the easiest fix would be to add one paragraph to to 
check that (x,y) is on the curve. The spec already deals with the 
cofactor>1 in section 9.1.