Re: [pkix] Edwards/DJB curves - New PKI(X) work?

[Johannes Merkle <[e-mail]>]

Anders Rundgren wrote on 14.08.2014 18:05:
> On 2014-08-14 16:51, Johannes Merkle wrote:
>> Anders Rundgren wrote on 14.08.2014 13:36:
>>> But the inclusion of new algorithms in X.509 structures sounds
>>> like a PKI(X)-like task.
>>>
>>
>> Well, "new algorithms" is not exactly the right term for introducing a new curve representation; it's rather a new
>> semantic of public keys, digital signatures and cryptograms. (There are some people on the CFRG advocating
>> standardization of simplified ECC-based signature algorithms, like Schnorr signatures, but currently, the discussion
>> focuses on curves and their representation.) But essentially, you are right: if we want to use new semantics in PKIX,
>> new specs for X.509 certs / CRLs, for CMS etc. would be needed.
> 
> I'm not a cryptographer you know :-)
> 
> Anyway, wouldn't you need algorithms also like EdDSA-SHA256 or would ECDSA-SHA256 apply?
> Again, pardon a non-cryptographer for asking stupid/strange questions...

The usage of ECDSA-SHA256 within PKIX is already fully specified in RFC 5758. The curve (more specifically, the elliptic
curve parameters) are a property of the public key not of the digital signature, DH value or cipher text.
In order to use other curves, you just need to replace the OID for the named curve which is a parameter of the
SubjectPublicKeyInfo according to RFC 5480.

As I said, there are ideas to define new digital signature algorithms, like Schnorr signature or EdDSA. The motivation
for this is both performance and ease of (secure) implementation, but is is perfectly possible to use Montogomery or
Edwards curves with ECDSA in a secure and efficient way. There has been some confusion about this, because Daniel
Bernstein has introduced his Edwards curve Ed25519 together with a new signature algorithm (and also suggested to use
the Montgomery curve Curve25519 for DH only), but this combination of curves and algorithms (and, actually, of a
specific arithmetic as well) is just an optimization, and does not really fit the modular approach of PKIX.

My perception is that CFRG (and tls WG) will take one step after another and will now standardize new curves only. After
that is accomplished, they might consider standardization of new signature algorithms, but this has not been decided yet.

-- 
Johannes