Re: [TLS] Should we require compressed points

[Yoav Nir <[e-mail]>]

> On Oct 21, 2014, at 6:03 PM, Eric Rescorla <[e-mail]> wrote:
> 
> 
> On Tue, Oct 21, 2014 at 5:01 PM, Hubert Kario <[e-mail] <mailto:[e-mail]>> wrote:
> From: "Eric Rescorla" <[e-mail] <mailto:[e-mail]>>
> To: [e-mail] <mailto:[e-mail]>
> Sent: Tuesday, 21 October, 2014 4:52:29 PM
> Subject: [TLS] Should we require compressed points
> 
> 
> https://github.com/tlswg/tls13-spec/issues/80 <https://github.com/tlswg/tls13-spec/issues/80>
> 
> Today we discussed the possibility of requiring support for compressed points
> in TLS 1.3 now that the IPR has expired.
> 
> Specifically, I propose that for TLS 1.3, we:
> 
> - Use only compressed points for the existing curves (and presumably
>   whatever superior format is defined for the CFRG-recommended
>   curves, as appropriate).
> 
> - Deprecate the Supported Point Formats extension for TLS 1.3
> 
> 
> For RFC 4492-bis, we might also consider requiring support for compressed
> points as well as uncompressed (already required) but this seems like a
> separable issue, since it's mostly in service of optimization rather than
> simplicity.
> 
> How does that impact possibility of adding more "exotic" curves like curve25519/Ed25519
> in some later point in time?
> 
> Hubert, thanks for your email.
> 
> I don't think it should impact it at all because you still have to advertise the curves you
> support. My assumption is that advertising curve X would be the same as advertising
> that you could support its defined point format(s).
> 

It does say that unless we re-introduce the extension, each curve with come with one single point format. I think that’s a fine idea that simplifies the code.

Yoav