Re: [TLS] Should we require compressed points

On Tue, Oct 21, 2014 at 8:11 AM, Michael StJohns <msj@nthpermutation.com>
wrote:
> On 10/21/2014 10:52 AM, Eric Rescorla wrote:
>
> https://github.com/tlswg/tls13-spec/issues/80
>
> Today we discussed the possibility of requiring support for compressed
> points
> in TLS 1.3 now that the IPR has expired.
>
> Specifically, I propose that for TLS 1.3, we:
>
> - Use only compressed points for the existing curves (and presumably
> whatever superior format is defined for the CFRG-recommended
> curves, as appropriate).
>
> - Deprecate the Supported Point Formats extension for TLS 1.3
>
>
> I'm pretty much opposed to the former and I guess by extension the latter.
>
> There's a very large body of code that doesn't support anything except
type
> 0x04(uncompressed) X9.63 point encodings. If you want to add support for
> compressed points (or hybrid compressed), I don't think that's
necessarily a
> bad idea, but not at the expense of removing support for uncompressed
> points. If you wanted to remove the supported point format extension, I
> guess you could mandate support for both compressed and uncompressed (and
> hybrid?).

There is a large body of code that doesn't support TLS 1.3 as well.
>
> As a second item, I would estimate the chance we're going to see
compressed
> points in X509 certificates as a regular thing prior to about 10 years
from
> now as very small, meaning that any general transition to EC based suites
is
> going to require uncompressed point support.

Yes, but uncompressed points are not a security concern in X509, but they
are in ECDH. Furthermore, the cost of adding compression support is very
small: it's a square root, a check, and potentially flipping the sign. The
benefit is that invalid point attacks are much harder to carry out.

>
> Lastly, while the base IPR for point compression seems to be no longer of
> concern, I've still been told to avoid it for a few more years due to
> implementation patents related to compression. I'm not sure how worrisome
> that is, but its one of the reasons that binary curves aren't in broader
use
> still.
>
> Just my $.02
>
> Mike
>
>
>
> For RFC 4492-bis, we might also consider requiring support for compressed
> points as well as uncompressed (already required) but this seems like a
> separable issue, since it's mostly in service of optimization rather than
> simplicity.
>
> What do people think?
> -Ekr
>
>
>
>
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

--
"Those who would give up Essential Liberty to purchase a little Temporary
Safety deserve neither Liberty nor Safety."
-- Benjamin Franklin