Re: [TLS] Curve25519 in TLS

[Rob Stradling <[e-mail]>]

On 09/09/13 21:08, Simon Josefsson wrote:
> Douglas Stebila <[e-mail]> writes:
>
>> There are other reasons to support curve25519, including efficiency
>> and resistance to side-channel attacks because constant-time
>> implementations.
>
> I agree.  To be able to move forward with standardization of the idea,
> an Internet Draft may help.  I have create one:
>
> http://www.ietf.org/id/draft-josefsson-tls-curve25519-00.txt
>
> Feedback most welcome!

Simon, thanks for creating this draft.

draft-merkle-tls-brainpool-04 (on which you've based this new draft) says:
    "While the ASN.1 object identifiers
    defined in [RFC5639] already allow usage of the ECC Brainpool curves
    for TLS (client or server) authentication through reference in X.509
    certificates according to [RFC3279] and [RFC5480] , their negotiation
    for key exchange according to [RFC4492] requires the definition and
    assignment of additional NamedCurve IDs."

Your draft defines a NamedCurve ID for Curve25519, thereby enabling it 
to be used for key exchange.  But what about "(client or server) 
authentication through reference in X.509 certificates..."?

I'm not aware of an equivalent of RFC5639 for Curve25519.  Should we 
create one?  Or could we simply define some new ASN.1 Object Identifiers 
in your draft?

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online