Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

[Peter Gutmann <[e-mail]>]

Viktor Dukhovni <[e-mail]> writes:

>If we have an opportunity to advance the state of the art, and use (subject
>to CFRG review, ...) new EC techniques based on lessons learned after ECDSA,
>that are more performant and less prone to implementation errors, then there
>is a good reason to add new curves.

If we're going to do that then we need to have something like the
AES/SHA-3/PHC competition to decide on a suitable curve (and whatever other
deckchairs are going to be rearranged in TLS 1.3), not just take the first
trendy thing that pops up.  I have a great deal of respect for djb and he
designs some really good stuff, but with the thought of having to implement
huge amounts of new material for TLS 1.3 (after already having had to do it
for 1.2) I really, really don't want to have to start again from scratch if,
in two years' time, someone finds some issue in 25519 and/or the other bits
that are being thrown in.  Using the oldest SSL algorithms that come to mind,
3DES, DHE, and HMAC-SHA1, I'm pretty confident that I'm, as I quoted a
cryptographer earlier, "unlikely to be surprised".  Introducing several trendy
new algorithms all at once gives me nothing like that level of confidence.

Peter.