Re: [dnsext] I-D Action: draft-ietf-dnsext-dnssec-algo-imp-status-04.txt

[Joe Abley <[e-mail]>]

On 2013-03-12, at 09:27, Andrew Sullivan <[e-mail]> wrote:

> On Mon, Mar 11, 2013 at 04:12:01PM -0400, Andrew Sullivan wrote:
>> On Mon, Mar 11, 2013 at 04:01:04PM -0400, Joe Abley wrote:
> 
>>> English, in the RFC series. What is the reason for appearing to
>>> promote one over the other?
>> 
>> I don't know; that's what the WG said before. 
> 
> The reasoning in the draft behind recommending ECDSAP256SHA256 and
> ECDSAP384SHA384 and not GOST-ECC is that the former two "may see
> widespread use".

To give the quote more context, the draft says that the former two "may see widespread use due to the perceived similar level of security offered with smaller key size compared to the key sizes of algorithms such as RSA." The prediction of widespread use is based on a presumed advantage that smaller key sizes are good.

There's no citation for the cryptographic strength (perceived or otherwise) of ECDSAP256SHA256 or ECDSAP384SHA384 relative to the other "recommended" algorithms, i.e. RSASHA256, RSASHA1-NSEC3-SHA1 or RSASHA512.

RFC 6605 has this to say:

   Current estimates are that ECDSA with curve P-256 has an approximate
   equivalent strength to RSA with 3072-bit keys.  Using ECDSA with
   curve P-256 in DNSSEC has some advantages and disadvantages relative
   to using RSA with SHA-256 and with 3072-bit keys.  ECDSA keys are
   much shorter than RSA keys; at this size, the difference is 256
   versus 3072 bits.  Similarly, ECDSA signatures are much shorter than
   RSA signatures.  This is relevant because DNSSEC stores and transmits
   both keys and signatures.

which adds more detail, but also omits citations (beyond "current estimates"). I didn't look very hard, but I couldn't find a comparison between GOST R.34.10-2001 and RSA/SHA256.

In both ECDSA and GOST-ECC a public key Q = (x, y) is represented in DNSSEC as the concatenation x | y. 

In GOST R.34.10-2001 and ECDSA/P-256, the wire encoding is specified as 32 bytes for each of x and y, giving an encoded public key size of 512 bytes.

In ECDSA/P-384, the wire encoding is specified as 48 bytes for each of x and y, giving an encoded public key size of 768 bits.

Based purely on the motivation to reduce the key size (given that no citations are given for either ECDSA or GOST-ECC with respect to cryptographic strength relative to other algorithms) it seems that GOST-ECC has the same advantages as ECDSA/P-256 and is better than ECDSA/P-384.

> Does anyone have an argument that ECC-GOST also
> falls into that category?

Arguments about possible future widespread use are difficult to justify. Counter-examples (alg A is more likely to see use than alg B because A is encumbered, or is computationally expensive, or something) seem slightly easier to come up with. But since ECDSA and GOST-ECC are fundamentally so similar, it seems odd to me to treat them differently.

The only practical difference between ECDSA and GOST-ECC is where they were developed and standardised, and (once again) I think it'd be unfortunate if there was the perception that the GOST-specified algorithm was being under-promoted purely for geopolitical reasons.


Joe