Re: [Sidrops] Signed Object signed with Ed25519 (RFC 8419 proof-of-concept)

Job:

secp256r1 curve is also referred to as prime256v1 and P-256.  Personally, I think P-256 is easier to remember.  The NIST Prime Curves are used in many, many places.

I do not know of anyone that is using the NIST Koblitz Curves.  NIST SP 800-186, Section 3.3 says:

> This section specifies elliptic curves over binary fields where each curve takes the form of a
> curve in short-Weierstrass form and is either a Koblitz curve (Section 3.3.1) or a pseudorandom
> curve (Section 3.3.2). Due to their limited adoption, elliptic curves over binary fields (i.e., all of
> the curves specified in Section 3.3) are deprecated and may be removed from a subsequent
> revision to these guidelines to facilitate interoperability and simplify elliptic curve standards and
> implementations. New implementations should select an appropriate elliptic curve over a prime
> field from Section 3.2.

Section 3.2 includes the Prime Curves in three different forms.

Russ

> On Sep 4, 2023, at 12:14 PM, Job Snijders <job=40fastly.com@dmarc.ietf.org> wrote:
> 
> On Mon, Sep 04, 2023 at 09:26:37AM -0400, Russ Housley wrote:
>> Job wrote:
>>> 
>>> Which RFC specifies the parameters to use with ECDSA in CMS?
>> 
>> I think you are looking for RFC 5753.
> 
> Thanks!
> 
> Am I correct to interpret RFC 5753 to mean that secp256r1 (aka X9.62
> prime256v1, aka NIST P-256) is recommended over secp256k1 for use in CMS?
> I see no mention of secp256k1 in RFC 5753.
> 
> For comparison I generated a secp256r1 variant of the same ASPA object,
> it clocks in as the second smallest:
> 
> RSA EE w/ RSA CA:              1701 bytes [1]
> secp256k1 w/ sha256 w/ RSA CA: 1463 bytes [3]
> secp256r1 w/ sha256 w/ RSA CA: 1284 bytes (attached)
> Ed25519 w/ sha512 w/ RSA CA:   1281 bytes [2]
> 
> The 179 byte difference between secp256k1 and secp256r1 is caused by the
> secp256k1 public key being encoded differently. The secp256k1 public key
> is encoded in 'explicit form', this means that in addition to the 64
> byte public key, also a large prime, A & B fields, an uncompressed
> Generator field, and an Order field are encoded.
> 
> Kind regards,
> 
> Job
> 
> [1]: https://console.rpki-client.org/chloe.sobornost.net/rpki/RIPE-nljobsnijders/5m80fwYws_3FiFD7JiQjAqZ1RYQ.asa.html
> [2]: https://mailarchive.ietf.org/arch/msg/sidrops/CG2BWxOa6Ly8F0huOULIBd4hGEc/
> [3]: https://mailarchive.ietf.org/arch/msg/sidrops/5IpqPtnJlhVr2BztFxuNnV6xNck/
> <prime256v1.asa>_______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops