Re: [Cfrg] big-endian short-Weierstrass please

[Daniel Kahn Gillmor <[e-mail]>]

On Wed 2015-01-28 16:23:27 -0500, Dan Brown wrote:
> For example, RFC 4492 allows curves to be specified in Weierstrass
> form, not just as named form.  I don't know if any TLS implementations
> support the specified curve option, but if they do, then it would be
> nice if the new implementations could talk to them, using the new
> curves.

Over in the TLS WG, we're working on actively deprecating the custom
curve selection mechanism and moving strictly toward pre-named curves
(this is true for finite-field DH as well).  Custom curve and FFDHE
group selection will be gone in TLS 1.3.

oThe over-flexibility in EC group selection isn't widely used, and when
it is used, there is no clear way for a receiving implementation to have
confidence in the structure of the arbitrary curves provided (even
simple primality-testing is probably too expensive for most to do at
runtime), or to have a reasonable (efficient, constant-time)
implementation.

I don't think this is a particularly useful half-measure.  I'd rather
see implementations pick up new, reasonably-vetted curves than try to
muddle through supporting arbitrary curves provided by the peer.

     --dkg