Re: [http-auth] CFRG Curves in Mutual

[大岩寛 <[e-mail]>]

Dear Ilari,

sorry for the late reply.

If someone provides voluntary work for both implementing and defining the
spec for Edwards curve, I'll be happy to consider it for merger, 
upon some decisions/suggestions from the WG.
In my current stance, working for new curve (especially for Edwards curves)
can be done with a separate algorithm specification, just like adding a new
ciphersuite for TLS.

We have once discussed the elliptic curve choices in the past with our WG and
CFRGs, and I understood that it is too early to decide one curve or two, and
it is important (at this time) to have modularity (ability to switch)
for future decisions.
That's why our Mutual spec have separated the Weierstrass curve spec
to the "algorithms" draft, so that we can easily write a "new" draft
for any new curves.
(Also, I personally think that the current spec is enough for "demonstrating"
 ability for incorporating EC-based key exchanges to implement.)

Of course, if one has a chance to promote Mutual to the Standards Track in future,
we should make some decision on the "must-to-implement" algorithms then.


Regarding to point formats, current definition is designed only considering
Weierstrass curves, and if it does not fit well for a curve with
different characteristics, we should have another representation.

Chain-shifting is, yes, one performance caveat in the current definition, but
I think it is not critical and is the easiest to understand for Weierstrass curves.
If we would have some defined "standards" on the representations of
curve points (e.g. for Edwards curves), we will happily adapt that.

-- 
Yutaka OIWA, Ph.D.       Leader, Cyber Physical Architecture Research Group
                                  Information Technology Research Institute
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[e-mail]>, <[e-mail]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

> -----Original Message-----
> From: http-auth [mailto:[e-mail]] On Behalf Of Ilari
> Liusvaara
> Sent: Saturday, November 14, 2015 10:32 PM
> To: [e-mail]
> Subject: [http-auth] CFRG Curves in Mutual
> 
> Should CFRG curves (Edwards25519 and Edwards448) be added to Mutual spec?
> 
> The curves (but no point formats) are defined by CFRG-CURVES, which has been
> sent to the RFC Editor (currently being copyedited).
> 
> The existing point format in the Mutual draft is rather bad[1] (especially for
> these curves), but as far as I can tell, it is not mathematically unworkable.
> 
> (The point decoding may also divide by zero. Fortunately all the points where
> this happens are of order 4 and as such invalid anyway).
> 
> 
> [1] Putting the y sign bit at LSB position makes one chainshift the entiere
> thing. And for Edwards curves, usually y is written in full and x is compressed
> to one bit, not the vice versa that is usually done with Weierstrass curves.
> 
> 
> -Ilari
> 
> _______________________________________________
> http-auth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-auth