Re: [pkix] Edwards/DJB curves - New PKI(X) work?

[Michael StJohns <[e-mail]>]

At 10:27 AM 8/18/2014, Stephen Farrell wrote:
>> 1. Creating external representations of Keys, Curves and Algorithms that
>>    can be reused by various standards in development or in need of a
>> "refresh".
>>    This is actually a bit urgent since the using systems are designed
>> *now*.
>
>I don't agree. Some of the CFRG discussion may touch on that
>so getting ahead of them here would be a bad idea. And CFRG
>have set themselves a target of getting back to the TLS WG
>before November, so I'd recommend a bit of patience for now,
>for this part of the puzzle.


There's at least two different things going on here - the possible selection of new curve/math/etc, and the representational aspects of those choices.  I've been commenting on/arguing about draft-turner-thecurve25519function with the authors and realized during that interaction that our process is really rather poorly set up to deal with these two items appropriately.

For example, the math in draft-turner... has no dependency at all on endianess (pretty much every element of the system is a bignum integer), but there are about 5-8 lines that state an absolute requirement that the representation of those elements when externalized be little endian.  Indeed, there have already been several arguments about representation of Curve25519 elements on the TLS mailing list and elsewhere.    I'm somewhat disturbed that this non-WG, non-IETF, CFRG draft could end up setting (or strait jacketing) representations for all IETF protocols without input from those involved in the protocol formation.

I guess the question comes down to competencies.  I believe the CFRG competent to rule on the security of the math.  I would suggest that it may be outside CFRG's purview to be directing protocol representations.  But the CFRG is not set up to handle the wide participation necessary to discuss representational forms nor would I really want it to be. 

So getting back to your point above - happy to have the CFRG pick the math.  But PKIX/TLS/IPSec et al should get a say in on-the-wire representation.  If we can keep those two separate in the decision process, I expect you'll have less dissent in later stages.

Mike