[TLS] Additional Elliptic Curves (Curve25519 etc) for TLS ECDH key agreement

[Simon Josefsson <[e-mail]>]

Dear WG,

I may have missed to announce this document before, since some people
appear to have missed it.  This email is an attempt to introduce the
draft to the TLS WG properly.

This draft started out as specifying Curve25519 ECDHE key agreement for
TLS, back on September.  Manuel Pegourie-Gonnard jumped in as co-author
and has added details on public/private key representation, shared
secret computation, and test vectors, for the -02 draft.

In the latest -03 version of the draft, I have changed the document to
specify EC Named Curve code points for all "additional elliptic curves"
(i.e., Curve25519, E382, M383, Curve3617, M511, E521).  Some of the
Curve25519-related text may no longer be applicable to all curves, but
hopefully that can be fixed later on.

The latest draft is here:
http://tools.ietf.org/html/draft-josefsson-tls-curve25519-03

The additional curves come from the following CFRG draft, and my current
thinking is that our draft (for TLS) would stay in sync with the list of
curves in the CFRG document.

http://tools.ietf.org/html/draft-ladd-safecurves-02

We'd appreciate general feedback on the draft, especially if there is
any interest in adopting this document, and particular feedback on the
following points:

1) Do we need all these curves defined for TLS?  What is the selection
   critera for including/exluding some of the curves?  Is that a TLS
   process, or an CFRG process?

2) Does description of private/public key representation and computation
   of shared secret belong in draft-josefsson-tls-curve25519?  It has to
   be somewhere, I believ, but possibly this could go into
   draft-ladd-safecurves, or some other generic document, unless there
   are TLS-specific aspects.  Insight into this would be appreciated.

Cheers,
/Simon