Re: [pkix] Edwards/DJB curves - New PKI(X) work?

[Anders Rundgren <[e-mail]>]

On 2014-08-15 09:38, Johannes Merkle wrote:
> Anders Rundgren wrote on 14.08.2014 18:05:
>> On 2014-08-14 16:51, Johannes Merkle wrote:
>>> Anders Rundgren wrote on 14.08.2014 13:36:
>>>> But the inclusion of new algorithms in X.509 structures sounds
>>>> like a PKI(X)-like task.
>>>>
>>>
>>> Well, "new algorithms" is not exactly the right term for introducing a new curve representation; it's rather a new
>>> semantic of public keys, digital signatures and cryptograms. (There are some people on the CFRG advocating
>>> standardization of simplified ECC-based signature algorithms, like Schnorr signatures, but currently, the discussion
>>> focuses on curves and their representation.) But essentially, you are right: if we want to use new semantics in PKIX,
>>> new specs for X.509 certs / CRLs, for CMS etc. would be needed.
>>
>> I'm not a cryptographer you know :-)
>>
>> Anyway, wouldn't you need algorithms also like EdDSA-SHA256 or would ECDSA-SHA256 apply?
>> Again, pardon a non-cryptographer for asking stupid/strange questions...
>
> The usage of ECDSA-SHA256 within PKIX is already fully specified in RFC 5758. The curve (more specifically, the elliptic
> curve parameters) are a property of the public key not of the digital signature, DH value or cipher text.
> In order to use other curves, you just need to replace the OID for the named curve which is a parameter of the
> SubjectPublicKeyInfo according to RFC 5480.
>
> As I said, there are ideas to define new digital signature algorithms, like Schnorr signature or EdDSA. The motivation
> for this is both performance and ease of (secure) implementation, but is is perfectly possible to use Montogomery or
> Edwards curves with ECDSA in a secure and efficient way. There has been some confusion about this, because Daniel
> Bernstein has introduced his Edwards curve Ed25519 together with a new signature algorithm (and also suggested to use
> the Montgomery curve Curve25519 for DH only), but this combination of curves and algorithms (and, actually, of a
> specific arithmetic as well) is just an optimization, and does not really fit the modular approach of PKIX.
>
> My perception is that CFRG (and tls WG) will take one step after another and will now standardize new curves only. After
> that is accomplished, they might consider standardization of new signature algorithms, but this has not been decided yet.
>

Thanx for the update!
It looks very messy to me.

Personally I wonder if CFRG will be able to stop new signature algorithms
since OpenSSH already supports EdDSA:
http://www.gossamer-threads.com/lists/openssh/dev/57162

Anders


Anders