Re: [TLS] Curve25519 in TLS and Additional Curves in TLS

[Yoav Nir <[e-mail]>]

On Apr 9, 2014, at 6:57 PM, Andrey Jivsov <[e-mail]> wrote:

> Re endianess,
> 
> shouldn't the decision here be based on the current distribution of little v.s. big endian architecture on CPUs that are likely used in TLS servers and accelerators?
> 
> ( It doesn't matter much for end-clients, I suppose. One may argue that this doesn't matter for the rest either. But then the argument goes that the big endian is the traditional canonical representation. )

It became the canonical representation when the Internet ran on Sun boxes with Sparc chips, which were Big-endian, and a little bit on other platforms such as mainframes and powerPCs (which were also big-endian) and VAX and Intel (which were little-endian). Now Intel dominates the servers, and the clients are split among Intel and ARM, both of which are little-endian. 

Regardless, reversing a string of bytes is such an efficient process, that it probably makes no measurable difference in performance which way the bits on the wire are read and written.

I think the decision should be made based on convenience and the chance for errors, although I can’t tell which way that goes. BTW: the same decision should be made for ChaCha/Salsa and Poly1305.

Yoav