Re: [TLS] Unwarrented change to point formats

[Watson Ladd <[e-mail]>]

On Sun, Jul 27, 2014 at 1:26 PM, Eric Rescorla <[e-mail]> wrote:
>
>
>
> On Sun, Jul 27, 2014 at 11:25 AM, Paterson, Kenny
> <[e-mail]> wrote:
>>
>> Watson,
>>
>> There was certainly support for Curve25519 at the CFRG interim phone
>> conference, from my reading of the transcript.
>>
>> I don't think the reasons for the TLS WG to ask for our input are
>> nebulous, as you put it. I'd say they were taking a responsible approach,
>> charging us as experts to explore the alternatives carefully and make
>> recommendations. This choice will affect the future security of TLS for
>> years - or decades - to come. So we have to get it right.
>
>
> This reflects my understanding as well.
>
>
>>
>> That request to us does not mean anyone is ignoring existing drafts, as
>> you write. I am also not aware of this IETF-wide requirement that you
>> mention. I believe it's a "nice to have", but not a hard requirement.
>
>
> Speaking only for myself, I don't think there's anything particularly
> mysterious here. The TLS WG is not chartered to do this kind of analysis
> so we've turned to the CFRG. It would clearly be most efficient if the IETF
> had a common set of cryptographic primitives where possible. It's true
> that TLS was the first WG to try to write down a specific request, but it
> seems likely that our needs are mostly common with other protocols.

This kind of analysis is much easier than the kind the TLS WG has to engage
in to ensure no more surprises. In particular since a lot of the
issues have to do
with performance and uptake, it's not clear the CFRG knows more about them then
the TLS WG.

>
> To take a specific set of cases. TLS has three major uses for public key
> crypto of this type:
>
> - Key establishment
> - Digital signatures over handshake messages (ServerKeyExchange,
>   CertificateVerify, etc.)
> - Digital signatures over certificates.
>
> It seems likely that key establishment shares common requirements for
> multiple protocols. Similarly, it would be quite convenient if the
> signatures
> used in TLS were the same as those used for the certificates used for TLS,
> even though the latter are not defined in TLS. So, when I say an IETF-wide
> set of recommendations that's the kind of thing I mean.
>
> I wasn't aware that any of this was particularly controversial.

You had a draft in hand, got a reply that "yeah, looks good", and then
went back to ask for
a completely different design process, for reasons never discussed.
It's the second round
that's confusing me.

What was wrong with the curve25519 draft?

Sincerely,
Watson Ladd

>
> -Ekr
>
>
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin