Re: [Cfrg] big-endian short-Weierstrass please

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Jan 29, 2015 at 12:50 PM, Watson Ladd <[e-mail]> wrote:
>
> > More importantly, I can't use your curves unless you can prove to me
> that they are secure. And the fact we are having trouble doing that in this
> group proves that it is not possible to achieve that in a protocol.
>
> We are not having trouble with that  in this group. Nobody disputes that
> any of the proposed curves are secure, or the details of generation.
>
> Instead, we're arguing about endiannes. I've tried to gather which primes
> everyone wants in one list, crickets.  Tony Arceli posts about signatures,
> 5 messages. Big v. Little, 40.
>
> Of course a malicious party can leak whatever you send them.
>
What I meant is that we had great difficulty in choosing curve parameters
that were not suspect so we developed objective criteria that effectively
removed the 'malicious curve' issue.

At this point I am pretty certain that I will not want to use my existing
crypto boxes for the new curves. I certainly don't want my keys for the
algorithms we chose for their constant time implementation friendliness
being implemented on legacy hardware.


I am not keeping score here, but my understanding is that we have a rough
consensus for P255 for the performance curve as it is as near as damnit 256
bits, very fast and has a lot of deployment support. Arguing over a single
bit seems illogical for a performance curve that is going to be used in TLS
for ephemeral encryption, particularly if we can fix the TLS key agreement
algorithm so that ephemeral agreed keys are always at least as random as
both the master key and the ephemeral inputs.

The ridiculously high assurance prime is a different matter. Perhaps what
CFRG should do is to choose both P512 curve and P448.


Curves are a different matter... I doubt that it really matters very much
and the differences in speed are likely to turn out to depend on whose
hardware is used.

Easiest to explain is probably the best criteria.