Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Watson Ladd <[e-mail]>]

On Tue, Sep 2, 2014 at 8:33 AM, Stephen Farrell
<[e-mail]> wrote:
>
>
> On 02/09/14 16:19, Watson Ladd wrote:
>> On Tue, Sep 2, 2014 at 1:30 AM, Stephen Farrell
>> <[e-mail]> wrote:
>>>
>>> Just on this point...
>>>
>>> On 02/09/14 02:50, Benjamin Black wrote:
>>>> The various working groups and standards bodies have already answered the
>>>> question of what goes on the wire.
>>>
>>> That's not correct. When CFRG finish doing a great job here, then
>>> the TLS WG will have to assign new codepoints for ciphersuites and
>>> there is nothing stopping them defining new encodings at that point
>>> if that's needed. That'd just not be a big deal. And the same is
>>> true of other IETF activities. So what goes on the wire should be
>>> a non-issue for this discussion really.
>>
>> Aren't we replacing SEC1? And doesn't SEC1 specify encodings, which
>> other WGs use?
>
> CFRG is not replacing anything, but rather picking new additional
> curves.
>
> If those new curves turn out to be way more popular then maybe
> over time they'll displace use of others, but only time will
> tell that, not CFRG.
>
>> If we end up saying "pairs of integers" then we get a mess, where
>> software implementing the curves has to implement a large number of
>> encodings. If we specify things as strings of bytes, that's easy to
>> deal with. I've heard some people say this was a mistake, but I am
>> unconvinced by those arguments.
>
> The point is that afaik none of those arguments help to pick
> new curves. If CFRG want to suggest something for on-the-wire
> formats after having picked some curves that's fine and it may
> or may not be adopted by various IETF protocols, depending on
> how well it fits their needs I guess.
>
> Main point is: I don't believe wire-format issues make any
> difference when picking new curves.

*None* of the arguments advanced so far help with picking new curves.
What possible difference is there between NUMS and the DJB/Tanja
curves? None, because you can always put one in the form of the other.
The only solution is a coinflip.

>
> S.
>
>>
>> Sincerely,
>> Watson Ladd
>>
>>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin