[tcpinc] Making ECDHE-Curve25519 the only MTI for tcpcrypt

[David Mazieres <[e-mail]>]

Some of the tcpcrypt authors have talked over the proposal to make
ECDHE-Curve25519 MTI instead of P256 and P521.  We think this argment
has merit if it won't hamper standardization and adoption of the
protocol at this juncture.

One of the original motivations for making P256 MTI was that if P256 is
broken, then the world is in some trouble anyway.  A counter-argument
might be that such trouble could be slightly reduced if people could
turn on tcpcrypt with ECDHE-Curve25519.  Further tipping the balance in
favor of ECDHE-Curve25519 is the fact that it's probably easier to find
safe implementations of Curve25519 than P256 to embed in the kernel.
Certainly Curve25519 is a lot more widely used now than when we started
the tcpcrypt project, making it not unreasonable to revisit the
decision.

Question one is whether there's anyone in the working group who thinks
it would be a bad idea to make this change--i.e., to have a single MTI
algorithm, namely ECDHE-Curve25519.  If so, please speak up.

Question two, if no one object to this change and some people want to
see it, is whether it is now too late to make this change without
jeopardizing the RFC.  Can we still make such a change in last call?
It's obviously not a lot of text to change, but a fairly big semantic
change.  We'd appreciate guidance on this question from people with more
IETF experience.

Thanks,
David