Re: [TLS] Curve25519 in TLS

[Simon Josefsson <[e-mail]>]

Rob Stradling <[e-mail]> writes:

> Simon, thanks for creating this draft.
>
> draft-merkle-tls-brainpool-04 (on which you've based this new draft) says:
>    "While the ASN.1 object identifiers
>    defined in [RFC5639] already allow usage of the ECC Brainpool curves
>    for TLS (client or server) authentication through reference in X.509
>    certificates according to [RFC3279] and [RFC5480] , their negotiation
>    for key exchange according to [RFC4492] requires the definition and
>    assignment of additional NamedCurve IDs."
>
> Your draft defines a NamedCurve ID for Curve25519, thereby enabling it
> to be used for key exchange.  But what about "(client or server)
> authentication through reference in X.509 certificates..."?
>
> I'm not aware of an equivalent of RFC5639 for Curve25519.  Should we
> create one?  Or could we simply define some new ASN.1 Object
> Identifiers in your draft?

Yes perhaps.  What would the purpose of using Curve25519 in X.509
certificates be?  Performance is less critical there than for ECDH, but
if you or someone else has numbers indicating X.509 signature
verification being a performance bottle neck I would be convinced
otherwise.  There could be other reasons than performance though, but
they should be articulated and examined.

RFC 5639 contains a lot of things, is there anything other than the OID
and PKIX usage you think is relevant for Curve25519?

/Simon