Re: [TLS] Unwarrented change to point formats

"Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk> Sun, 27 July 2014 18:26 UTC

Return-Path: <Kenny.Paterson@rhul.ac.uk>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EC911A0B10 for <tls@ietfa.amsl.com>; Sun, 27 Jul 2014 11:26:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.602
X-Spam-Level:
X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dMH4ZBanvcbQ for <tls@ietfa.amsl.com>; Sun, 27 Jul 2014 11:25:58 -0700 (PDT)
Received: from emea01-am1-obe.outbound.protection.outlook.com (mail-am1lp0015.outbound.protection.outlook.com [213.199.154.15]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 273A51A0AE5 for <tls@ietf.org>; Sun, 27 Jul 2014 11:25:58 -0700 (PDT)
Received: from DBXPR03MB383.eurprd03.prod.outlook.com (10.141.10.15) by DBXPR03MB381.eurprd03.prod.outlook.com (10.141.10.11) with Microsoft SMTP Server (TLS) id 15.0.995.14; Sun, 27 Jul 2014 18:25:55 +0000
Received: from DBXPR03MB383.eurprd03.prod.outlook.com ([10.141.10.15]) by DBXPR03MB383.eurprd03.prod.outlook.com ([10.141.10.15]) with mapi id 15.00.0995.014; Sun, 27 Jul 2014 18:25:55 +0000
From: "Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk>
To: Watson Ladd <watsonbladd@gmail.com>
Thread-Topic: [TLS] Unwarrented change to point formats
Thread-Index: AQHPqPtIfxZu0QqDV0qbT2QAUQQVkpu0PnH4
Date: Sun, 27 Jul 2014 18:25:54 +0000
Message-ID: <ACA887E2-DFE3-41A3-9A75-BAA72843169A@rhul.ac.uk>
References: <CACsn0cnf64Lj0om9hzvfZymo1KRG6FOiicfcDw3ysfGwaAby3g@mail.gmail.com>
In-Reply-To: <CACsn0cnf64Lj0om9hzvfZymo1KRG6FOiicfcDw3ysfGwaAby3g@mail.gmail.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [78.146.58.177]
x-microsoft-antispam: BCL:0;PCL:0;RULEID:
x-forefront-prvs: 0285201563
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(189002)(199002)(24454002)(51704005)(74502001)(4396001)(74662001)(74482001)(83716003)(36756003)(77982001)(31966008)(15975445006)(76482001)(79102001)(82746002)(21056001)(46102001)(1411001)(101416001)(110136001)(2656002)(105586002)(107046002)(87936001)(86362001)(33656002)(95666004)(85306003)(99396002)(92726001)(92566001)(76176999)(83072002)(85852003)(54356999)(81542001)(50986999)(83322001)(80022001)(66066001)(106356001)(81342001)(64706001)(20776003)(19580395003)(19580405001)(106116001)(104396001); DIR:OUT; SFP:; SCL:1; SRVR:DBXPR03MB381; H:DBXPR03MB383.eurprd03.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; LANG:en;
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: rhul.ac.uk
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/1Lrjie1q86O68LZF7DzCfxl2eJY
Cc: "cfrg@irtf.org" <cfrg@irtf.org>, "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Unwarrented change to point formats
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Jul 2014 18:26:00 -0000

Watson,

There was certainly support for Curve25519 at the CFRG interim phone conference, from my reading of the transcript. 

I don't think the reasons for the TLS WG to ask for our input are nebulous, as you put it. I'd say they were taking a responsible approach, charging us as experts to explore the alternatives carefully and make recommendations. This choice will affect the future security of TLS for years - or decades - to come. So we have to get it right. 

That request to us does not mean anyone is ignoring existing drafts, as you write. I am also not aware of this IETF-wide requirement that you mention. I believe it's a "nice to have", but not a hard requirement. Can you point to something more solid that is demonstrably a consensus view?

You will note from my previous emails summarising the meeting in Toronto that backwards compatibility with the existing wire format is regarded as being desirable but not essential by the TLS WG leadership. If it can be done, it will make adoption easier; if not, we can change it, but it will need some careful drafting to make sure it's crystal clear. 

The fact that the small group who run OpenSSH has adopted a couple of schemes based on a particular curve does not necessarily make that curve the right choice for TLS. I also don't regard that as wide adoption, as you put it. I'm not aware of a public, requirements-driven process behind their choice. That's what we are attempting here.  

Your continued inputs to the process are most welcome. 

Regards

Kenny 

> On 26 Jul 2014, at 18:59, "Watson Ladd" <watsonbladd@gmail.com> wrote:
> 
> Dear all,
> Curve25519 was a draft. Curve25519 came back with good reviews from
> the CFRG. End of story? No: the TLS WG leadership has decided to ask
> for the choice of curves, on nebulous criteria, ignoring existing
> drafts, on the basis that the curves must be applicable "IETF wide".
> 
> I don't see the reason for this, especially given that OpenSSH has
> implemented and deployed Curve25519 and Ed25519, complete with
> Montgomery form on the wire.  Arguing that we need twisted Edwards
> point formats everywhere for consistency with existing libraries
> ignores what has already been deployed and widely adopted.
> 
> Sincerely,
> Watson Ladd
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>