Re: [TLS] Curve25519 draft

[Eric Rescorla <[e-mail]>]

On Sun, May 4, 2014 at 5:45 PM, Paul Hoffman <[e-mail]> wrote:

> On May 4, 2014, at 5:17 PM, Eric Rescorla <[e-mail]> wrote:
>
> > My understanding was a bit more modest, namely that the CFRG intended
> > to produce a recommendation by IETF Toronto and that Curve25519 was
> > probably the leading contender for that recommendation at the 128-bit
> > security level, but that they weren't quite ready to commit. So people
> were
> > to go off and do drafts with an aim to have an answer by YYZ. Though
> > perhaps I am the one who misunderstood.
>
> I think you probably were. The way I remember it was that Dave McGrew
> asked if anyone had any objections to Curve25519 being the single curve
> proposal to the IETF, and there were crickets. I didn't hear any suggestion
> that CRFG would make any actual "recommendation".


If so that makes me sad. I thought the premise of the CFRG curve
effort was that they were going to make a recommendation. The
TLS chairs will reach out to the CFRG chairs and try to get some
clarity on what they propose to do.

-Ekr

> In either case, as a matter of process I would expect (or at least hope)
> that
> > the CFRG will send us some sort of formal statement of their
> recommendation
> > so that we have something specific to refer to for future.
>
> Even if they wanted to, it is still unclear to me how such a thing would
> happen formally. If it isn't going to happen formally, there is no reason
> to bother trying to force it.
> To me, this means that anyone who cares about Curve25519 for TLS or IPsec
> or S/MIME or SSH should go ahead and start writing drafts. If somehow the
> CRFG comes to a different conclusion, you might need to stop.
>
> --Paul Hoffman