[TLS] Using ECC Brainpool curves with TLS

[Johannes Merkle <[e-mail]>]

Hello all,

in RFC 5639, we have specified a new set of elliptic curve parameters for use in cryptographic applications. Meanwhile,
support for these ECC Brainpool Curves has been included in some crypto libraries as openssl (recently) and crypto++.
However, in order to use the Brainpool Curves with TSL (for authentication and/or key agreement), still some
specifications and IANA registry updates are needed. Therefore, an RFC specifying the usage of the ECC Brainpool Curves
with TLS has to be written.

In order to go forward with this, we would like to discuss some questions and potential issues. We would appreciate any
feedback on the following.

[Question 1] According to the update policy of the IANA registry EC Named Curve for TLS, such an RFC would have to be
shepherded by the TLS WG. Therefore, our first and most important question is: Is the WG willing to shepherd this RFC?

[Question 2] What category will be preferred for this RFC, Standards Track or Informational RFC?

[Question 3] Actually, we also plan to prepare analogous specifications for IKE, so an option may be to write a common
RFC for TLS and IKE analogously to RFC 5114. Would this be a good idea, in particular as this would imply shepherding by
two WGs, or would it be better to prepare separate RFCs for IKE and TLS?

[Question 4] In RFC 5639, for each of the bit lengths 160, 192, 224, 256, 320, 384, 512 two curves are defined, one
being the "quadratic twist" of the other having the same algebraic structure (and hence, security level), but one of
them allows particular efficient arithmetic. In order to leave the choice of the curve for a given bit length to the
implementation we propose to register IANA values (for EC Named Curve) for both curves for each bit length. Of course,
this doubles the number of number assignments. Does anyone consider this a problem?

[Question 5] No IANA registries are required for DTLS. However, authors have to specify whether new identifiers for TLS
are suitable for DTLS as well. This should be done for the ECC Brainpool curves. Any comments on this?

Johannes
--
Johannes Merkle
secunet Security Networks AG
[e-mail]
www.secunet.com