Re: [TLS] Unwarrented change to point formats

[Eric Rescorla <[e-mail]>]

On Sun, Jul 27, 2014 at 11:25 AM, Paterson, Kenny <[e-mail]
> wrote:

> Watson,
>
> There was certainly support for Curve25519 at the CFRG interim phone
> conference, from my reading of the transcript.
>
> I don't think the reasons for the TLS WG to ask for our input are
> nebulous, as you put it. I'd say they were taking a responsible approach,
> charging us as experts to explore the alternatives carefully and make
> recommendations. This choice will affect the future security of TLS for
> years - or decades - to come. So we have to get it right.
>

This reflects my understanding as well.



> That request to us does not mean anyone is ignoring existing drafts, as
> you write. I am also not aware of this IETF-wide requirement that you
> mention. I believe it's a "nice to have", but not a hard requirement.


Speaking only for myself, I don't think there's anything particularly
mysterious here. The TLS WG is not chartered to do this kind of analysis
so we've turned to the CFRG. It would clearly be most efficient if the IETF
had a common set of cryptographic primitives where possible. It's true
that TLS was the first WG to try to write down a specific request, but it
seems likely that our needs are mostly common with other protocols.

To take a specific set of cases. TLS has three major uses for public key
crypto of this type:

- Key establishment
- Digital signatures over handshake messages (ServerKeyExchange,
  CertificateVerify, etc.)
- Digital signatures over certificates.

It seems likely that key establishment shares common requirements for
multiple protocols. Similarly, it would be quite convenient if the
signatures
used in TLS were the same as those used for the certificates used for TLS,
even though the latter are not defined in TLS. So, when I say an IETF-wide
set of recommendations that's the kind of thing I mean.

I wasn't aware that any of this was particularly controversial.

-Ekr