Re: [TLS] Curve25519 in TLS and Additional Curves in TLS

[Manuel Pégourié-Gonnard <[e-mail]>]

On 03/04/2014 18:52, Watson Ladd wrote:
> On Thu, Apr 3, 2014 at 1:55 AM, Manuel Pégourié-Gonnard
> <[e-mail]> wrote:
>> In the next iteration of the draft, it might change to
>>
>> 33 tt xx xx .. xx
>>
>> Where tt would be an "encoding type" which would allow for future extensions
>> like transmitting y too, or a bit of y, or (parts of) other representation (eg
>> Edwards coordinates).
> 
> I don't think this is a good idea. At the time when one side sees the
> point it is too late to negotiate. So points with different encodings
> should be indicated as different in the Client Hello message to enable
> negotiation of which one to send.

That's the intention, yes (indicating supported point formats in the existing
ClientHello and ServerHello extensions).

> Furthermore, I don't see benefit to
> the potential extensions yet for pure DH.
> 
Just because we can't see a benefit for extensions now doesn't mean we shouldn't
leave the door open for later ideas.

> Also, do we really need a length prefix on a string that is always 32
> bytes long? I get that the TLS encoding provides that, but length
> prefix formats are a can of worms: what should happen when 33 0 or 32
> 32 xx .. are encountered?
> 
Well, what's already hapenning: implementations check for consistency. This is
no different than with the current short Weierstrass curves.

Manuel.