Re: [Cfrg] ECC reboot

[Rob Stradling <[e-mail]>]

On 23/10/14 18:41, Alyssa Rowan wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 23/10/2014 15:27, Watson Ladd wrote:
>
>>> I'm inclined to agree with my colleague PHB, who wrote recently:
>>>   "The Web PKI will almost certainly be based exclusively on the
>>> ~512 level curve. The roots certainly will."
>> Previously, when given a choice of curves, the one with size 384 or
>> thereabouts was picked. Now you are saying you want the biggest
>> possible curve, regardless of the performance impact.
>
> Not wishing to speak for Rob, but what I _think_ he means here is simply
> that if there was one curve picked, he'd use it in principle; but given
> the choice between two curves (a strong fast curve, and a paranoid
> curve), he'd probably be tempted to go for the paranoid one for the roots?

Yes.

<snip>
> By the way, as a matter of practicality, would we perhaps be looking at
> some kind of hybrid transition period where existing ECDSA-P384-SHA384
> roots sign (purely by way of example) EdDSA-Curve25519-SHA512 end-entity
> certificates?

Either that or existing RSA roots cross-certifying next generation ECC 
roots.

> How would the choice of end-entity algorithms be
> restrained by the signing algorithms and curves used on the roots, or
> not? (I appreciate that may not really be a question for here, but for
> upstream in TLS or PKIX.)

Not.

BTW, we're in a hybrid transition period at the moment: our 
ECDSA-P384-SHA384 roots are cross-certified by our old RSA roots.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online