Re: [TLS] Curve25519 in TLS

[Rob Stradling <[e-mail]>]

On 13/09/13 15:10, Yoav Nir wrote:
>
> On Sep 13, 2013, at 12:27 PM, Rob Stradling <[e-mail]> wrote:
>
>> On 12/09/13 22:12, Nico Williams wrote:
>> <snip>
>>> Of course, in practice it's much easier to deploy new ECDH curves for
>>> key agreement than new signature algorithms because the former are
>>> easily negotiated in actual protocols, while the latter are less so.
>>
>> Disagree, I think.  Doesn't the "Supported Elliptic Curves Extension" make it easy enough for TLS?
>
> No, because the key that I use is the private key that matches the public key in the certificate I got from some vendor. If I got a certificate with the NIST P-256 curve, I can't use the Curve25519 signatures. I can only use the NIST P-256 curve, because that is what is in my certificate. For ECDHE I can support multiple curves.

Sure.

> This also affects the CAs. They can't deploy certificates with Curve25519 unless all browsers support those curves,

Disagree.  If only one browser signals support for the Curve25519 
NamedCurve in the "Supported Elliptic Curves Extension", then (suitably 
enhanced) servers could send Curve25519/Ed25519 certs to this browser 
and RSA/DSA/P-256/whatever certs to other browsers.

> so in reality, only the NIST curves are currently viable for signatures.

Agreed, but I'm thinking about the future.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online