Re: [TLS] Curve25519 in TLS

["Paul Bakker" <[e-mail]>]

> On 12/09/13 22:12, Nico Williams wrote:
> <snip>
> > Of course, in practice it's much easier to deploy new ECDH curves for
> > key agreement than new signature algorithms because the former are
> > easily negotiated in actual protocols, while the latter are less so.
> 
> Disagree, I think.  Doesn't the "Supported Elliptic Curves Extension"
> make it easy enough for TLS?
> 
> RFC4492 (Section 5.3) says:
>    "If the client has used a
>     Supported Elliptic Curves Extension, the public key in the server's
>     certificate MUST respect the client's choice of elliptic curves;"
> 
> So if a TLS Client advertises support for Simon's proposed Curve25519
> NamedCurve, then surely that Client is implying that it supports both
> Curve25519 for key exchange _and_ Curve25519 keys in certs?

I think what Nico means is that the ServerKeyExchange message allows for the
TLS protocol to handle yet-unnamed curves for key-exchange with any client
(that properly handles them).
(http://tools.ietf.org/html/rfc4492#section-5.4)

For the "Supported Elliptic Curves Extension" to 'work' you need the client
to know about the curve beforehand. It has to be named already.
Thus deployment is harder as client actually need to be upgraded.

Regards,
Paul Bakker