Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

Andrey Jivsov <> Sat, 28 June 2014 20:52 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 6F4121A0085 for <>; Sat, 28 Jun 2014 13:52:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, LOTS_OF_MONEY=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id F5TZoGpCEmsj for <>; Sat, 28 Jun 2014 13:52:27 -0700 (PDT)
Received: from ( [IPv6:2001:558:fe2d:44:76:96:27:243]) by (Postfix) with ESMTP id 86B081A0084 for <>; Sat, 28 Jun 2014 13:52:27 -0700 (PDT)
Received: from ([]) by with comcast id Kwg21o0010x6nqcADwsTsg; Sat, 28 Jun 2014 20:52:27 +0000
Received: from [] ([]) by with comcast id KwsS1o00G4uhcbK8YwsSYJ; Sat, 28 Jun 2014 20:52:26 +0000
Message-ID: <>
Date: Sat, 28 Jun 2014 13:52:26 -0700
From: Andrey Jivsov <>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
References: <> <> <> <> <> <>
In-Reply-To: <>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=q20140121; t=1403988747; bh=1t0neS9ojaunSCoUySj+ldRj4JFNqgKgN/TCzzNEh2o=; h=Received:Received:Message-ID:Date:From:MIME-Version:To:Subject: Content-Type; b=qeEb7l94gsp7OVo5sAsxaZEgJNZ17HYKVp4EkaWQIhwxD0lTXwZZ2qdL8xq3e5BfI SOk4nCLyyh9AJCIMygn4o9EvrTbyc5Oy48rZnFarNsXWBlB+MfrqwwLNzVgVjHU/HD 1mTE8cnERmbEFPhxJ+hn1YpAiPO2WIL9Um13c3cq9DEWe8WyCLCYkUA2CSmf4iRsa/ mcvw+dw8OYVEkOdEJlaoVbbD7eHe/D2goMXNQUjwGAilNeNsWgWLAmzGl15K7DfBei g0TjgfYyR9RQak+RuBCIpehUtWqqYkMhCRkgLn3TD3bIuh1YJrX53ZUMaPgkSIT3XR D5aIFFHBhuoEw==
Subject: Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 28 Jun 2014 20:52:29 -0000

On 06/28/2014 01:39 PM, Michael StJohns wrote:
> On 6/28/2014 4:31 PM, Andrey Jivsov wrote:
>> On 06/28/2014 12:59 PM, Michael StJohns wrote:
>>> >>>>  "IPR Issues":
>>> The specific set of IPR issues that concern me are the license and 
>>> copyright with respect to DJB's basic work.    Unless there is a 
>>> "perpetual, paid up, world-wide, irrevocable" license for anything 
>>> that he's done (or could do in this space) there are possible future 
>>> issues.  Something as simple as invoking the already existing 
>>> copyright on the curve data could be problematic.
>>> Note that I'm not saying this will happen, or that its even 
>>> contemplated,  but it's a potential problem that should be resolved 
>>> formally and legally.
>>> (It's possible there is such a document, but I went looking and 
>>> didn't find it.  Some of this is tagged "public domain" but that's 
>>> probably insufficient for most lawyers).
>>> If DJB et al is willing to transfer change control/copyright/patent 
>>> rights/moral rights to the IETF (via appropriate documentation), and 
>>> the IETF is willing to publish an actual standard then this 
>>> objection goes away. 
>> BTW, focusing on F(p) (which is not really an ECC) also helps with 
>> the above concerns. p = 2^n-C is free due to the following expired 
>> patent : .
>> IMO it would appear "safer" for hardware vendors to only 
>> implement/provide optimization primitives for F(p), for a couple of 
>> specific p's.
> If I generated parameters for F(p) and published them under normal 
> copyright, AFAIK you couldn't use them absent a copyright license 
> regardless of patent rights.   For the existing curves, those grants 
> of license exist in some form or another.   To avoid IPR issues, you 
> need a set of both technology (patent) rights and parameter 
> (copyright) rights.
> As I said, I just want the documentation to avoid future issues.

Staying within F(p), we know that 2^n - C is now free as an idea (ref. 
above). (There is a speculation is that P-521 was not made a part of 
Suite B due to that now expired patent )

It makes sense to have C smallest. C=189 for n=256 . ( As I wrote 
earlier, I don't see why it should be 2^255-19, but that p is selected 
using the same criteria )

It should be possible to find prior work by people who experimented with 
such primes. ( Starting from, regarding 
2^256-189, and walking back in time... )