Re: [TLS] Additional Elliptic Curves (Curve25519 etc) for TLS ECDH key agreement

On Sun, Jan 12, 2014 at 11:29 AM, Dr Stephen Henson
<lists@drh-consultancy.co.uk> wrote:
> On 12/01/2014 19:21, Salz, Rich wrote:
>> I don't want this question to get lost in the general discussion so I am explicitly addressing this to the AD's
>>
>>>> I think we should keep this consistency and have the point format for
>>>> the new curves defined in one standard, whatever that might be.
>>
>>> Since this format may be used by more than just TLS, and was originally defined outside the IETF, what would
>>> be the most appropriate place to discuss extending it?
>>
>> Some folks have been working on a concrete proposal, which is that we "take" 0x41 as a new marker byte in ECPoint, and use that to mean "key format defined by the curve"  Ask IANA to maintain a curve point-format registry.  For example, Curve25519 would have 0x41 followed by the 32 bytes of x-value for the key.
>>
>> So, where should such a document be started?
>>
>> Many of us are feeling pressure to implement ECDHA to get PFS for our customers, and see the efficiency of Curve25519 as very important.  That is, the  clock is ticking...
>>
>
> Based on the current text, perhaps draft-ladd-safecurves (which might get
> renamed) being discussed in CFRG? It already has some brief notes on key formats
> though not the same as above.

I've expanded the section on key formats. So far I'm using big-endian.
The last thing I want to do is
reignite the crusade. Yes, there is a software compatibility issue,
but it is a minor one.

>
> I'm thinking we'd have a section indicating a (recommended, suggested or just
> possible) key format and then the TLS, a certificate format document and any
> other interested protocols could reference it.

Good idea: in fact the latest versions have a compressed point format.
The compressed point patent is
expiring this summer, and I don't think it applies to anything that
isn't short Weierstrass anyway.

>
> Steve.
> --
> Dr Stephen N. Henson.
> Core developer of the   OpenSSL project: http://www.openssl.org/
> Freelance consultant see: http://www.drh-consultancy.co.uk/
> Email: shenson@drh-consultancy.co.uk, PGP key: via homepage.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin