Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

[Watson Ladd <[e-mail]>]

On Sun, Jun 29, 2014 at 8:12 PM, Salz, Rich <[e-mail]> wrote:
> Ø  Implication: The IETF will have to make some pronouncement or assurance
> as to the viability of Curve25519 to the wider world.  The IETF will have to
> maintain the Curve25519 standard.
>
> Mike, I know you’ve been involved in this stuff since before this stuff
> existed J, but I don’t understand this. Why do we have to make any assurance
> about anything other than ‘here is how to interoperate using 25519 in TLS’?

No, we are defining a standard, and we are making assurances. Let's
not kid ourselves: SPF might say experimental, but if you try to send
mail without it, you'll find out just how much of a standard it is. As
for making assurances, if someday a massive break is discovered in TLS
1.3 because we neglected cryptographic knowledge, we will rightfully
be blamed for it.

If 25519 was ROT13, a proposal to include it would rightfully be
laughed out of this WG. We've established the principle, now we're
just haggling over its limits.

Sincerely,
Watson Ladd

>
>
>
> We’re not defining a standard, we’re not assuring the world about anything.
> We’ll have an RFC that says “here’s  how to do the math for 25519 and other
> things needed to interoperate” and we’ll have other RFC’s that say “here’s
> how to use that curve in this protocol.”
>
>
>
> Why does it need to be more than that?  I know that I am not alone in this
> confusion.
>
>
>
>                 /r$
>
>
>
> --
>
> Principal Security Engineer
>
> Akamai Technologies, Cambridge, MA
>
> IM: [e-mail]; Twitter: RichSalz
>
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin