Re: [TLS] Should we require compressed points

[Viktor Dukhovni <[e-mail]>]

On Tue, Oct 28, 2014 at 10:35:25AM +0100, Manuel P?gouri?-Gonnard wrote:

> On 27/10/2014 23:10, Eric Rescorla wrote:
> > As I said above, I'm principally trying to get rid of negotiation so we have
> > one point format for each curve. I could certainly live with requiring 
> > uncompressed only for the X9.62 curves and then defining a new, cleaner
> > format for the new CFRG curves.
>
> If the goal is to get rid of negotiation, would it be reasonable to say that
> implementations MUST support both formats?

I think that Bodo's suggestion of separate IANA assignments for
compressed and uncompressed variants of curves makes the most sense.

With that, clients that need to interoperate with TLS <= 1.2 can
send the point format extension indicating uncompressed format for
legacy curves, and include the code points for the legacy
format-ambiguous curves, and send new code points for (some of the
same underlying) curves that have an implied format.

Brand new curves would then ideally be registered with a single
preferred point format that is most suitable for the curve.

-- 
	Viktor.