Re: [TLS] Should we require compressed points

[Michael StJohns <[e-mail]>]

On 10/21/2014 10:52 AM, Eric Rescorla wrote:
> https://github.com/tlswg/tls13-spec/issues/80
>
> Today we discussed the possibility of requiring support for compressed 
> points
> in TLS 1.3 now that the IPR has expired.
>
> Specifically, I propose that for TLS 1.3, we:
>
> - Use only compressed points for the existing curves (and presumably
>   whatever superior format is defined for the CFRG-recommended
>   curves, as appropriate).
>
> - Deprecate the Supported Point Formats extension for TLS 1.3

I'm pretty much opposed to the former and I guess by extension the latter.

There's a very large body of code that doesn't support anything except 
type 0x04(uncompressed) X9.63 point encodings.   If you want to add 
support for compressed points (or hybrid compressed), I don't think 
that's necessarily a bad idea, but not at the expense of removing 
support for uncompressed points.   If you wanted to remove the supported 
point format extension, I guess you could mandate support for both 
compressed and uncompressed (and hybrid?).

As a second item, I would estimate the  chance we're going to see 
compressed points in X509 certificates as a regular thing prior to about 
10 years from now as very small, meaning that any general transition to 
EC based suites is going to require uncompressed point support.

Lastly, while the base IPR for point compression seems to be no longer 
of concern, I've still been told to avoid it for a few more years due to 
implementation patents related to compression.  I'm not sure how 
worrisome that is, but its one of the reasons that binary curves aren't 
in broader use still.

Just my $.02

Mike

>
>
> For RFC 4492-bis, we might also consider requiring support for compressed
> points as well as uncompressed (already required) but this seems like a
> separable issue, since it's mostly in service of optimization rather than
> simplicity.
>
> What do people think?
> -Ekr
>
>
>
>
>
>
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls