Re: [TLS] sect571r1

[Viktor Dukhovni <[e-mail]>]

On Wed, Jul 15, 2015 at 11:52:13PM -0400, Jeffrey Walton wrote:

> > An auditor who believes that we can rigourously quantify the security
> > of these curves precisely enough to say which is stronger or more
> > closely "matches" AES-256, should be laughed out of the room and fired.
>
> Maybe so, but it is what it is. The IETF is probably not going to be
> able to change it.

Well, the auditor can't ask for curves with TLS that the specification
deprecates.  So removing oddball choices will help users fend off
clueless checklist-wielding auditors.

A modest amount of diversity is fine, but I would posit that anything
beyond a (conservative, performant, backup) triple is counterproductive.
Between the anticipated CFRG curves and the NIST prime curves, I
think we already have a couple too many.

The way I see it:

	conservative = Goldilocks
	performant = 25519
	backup = P-256, P-384, P-521 (legacy triple)

All the above should ultimately be MTI, with each peer prioritizing
either "conservantive" or "performant", and legacy peers do the
same with "P-256" or "P-384" (with P-521 as backup for both camps).

If there are signs that all these are about to fail, and we still
somehow are left with some curves we're willing to trust, we can
change the mix then.

-- 
	Viktor.