Re: [Cfrg] Point format endian

Paul Hoffman <> Tue, 27 January 2015 16:33 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id C3C531A036F for <>; Tue, 27 Jan 2015 08:33:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.347
X-Spam-Status: No, score=-1.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 4rm4CKxT1XUV for <>; Tue, 27 Jan 2015 08:33:25 -0800 (PST)
Received: from (Opus1.Proper.COM []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D8DA91A1A5A for <>; Tue, 27 Jan 2015 08:33:24 -0800 (PST)
Received: from [] ( []) (authenticated bits=0) by (8.15.1/8.14.7) with ESMTPSA id t0RGXIuX000850 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 27 Jan 2015 09:33:19 -0700 (MST) (envelope-from
X-Authentication-Warning: Host [] claimed to be []
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
Content-Type: text/plain; charset="us-ascii"
From: Paul Hoffman <>
X-Priority: 3 (Normal)
In-Reply-To: <>
Date: Tue, 27 Jan 2015 08:33:18 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <>
To: Derek Atkins <>
X-Mailer: Apple Mail (2.1993)
Archived-At: <>
Cc: "" <>
Subject: Re: [Cfrg] Point format endian
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 27 Jan 2015 16:33:28 -0000

On Jan 27, 2015, at 8:25 AM, Derek Atkins <> wrote:
> Paul,
> On Tue, January 27, 2015 11:07 am, Paul Hoffman wrote:
>> We do not need "consensus" in this RG, just assurance that what we
>> recommend does not have security holes. No one has suggested any security
>> holes based on the endianness. The argument that "using different math
>> would add code" is true, but pretty much irrelevant relative the to the
>> size of the code needed to add a new curve. There is no interoperability
>> issue: if someone messes up the math in either endian direction, they will
>> know the first time they test their code, and there is approximately
>> 2^-128 chance that if they got it wrong and only tested one vector, that
>> they will accidentally get a good result.
>> The longer we argue about our preferences (instead of actual security
>> issues), the worse off the IETF is.
> It is important for interoperability.  If I tell you that my ECC Public
> Key is 0102030405060708090a but you interpret that as 0a090807060504030201
> -- we will get different results even if both of us implement the math
> correctly.  So I would argue that transmission encoding of keys and
> results *is* a matter of security.

Correct: if you tell me your ECC public key and use a format that is the opposite of what is in the RFC, I won't understand it. That seems like an irrelevant argument.

> Then of course there's the matter of using the shared secret in another
> algorithm, like AES.  Again, byte-order differences would result in
> different AES keys.  Yet another matter of security.

See above. If you choose to use a format that is different than the RFC, you will not interoperate. 'Twas always thus.

> Yes, it just mean we just need to "choose one".  But for the last 20+
> years we've already chosen:  network-byte-order.

Repeating your preference when it has no security implications doesn't help. If the eventual RFC specifies a different order than what you are used to, you can choose to follow the RFC or not.

--Paul Hoffman