Re: [TLS] Obstacles to standardizing ECC in TLS

[Eric Rescorla <[e-mail]>]

On Mon, Jun 9, 2014 at 2:40 PM, Watson Ladd <[e-mail]> wrote:

> Dear all,
>
> While I think that ECC ciphersuites and some well chosen curves need
> to be core, MTI features of TLS 1.3 for performance issues, I think
> there a few issues that need to be addressed.
>
> The first is that RFC 6090 is wrong: the formulas are incorrect, and
> so it should not be cited.
>
> The second is that the CFRG has not yet decided which curves to use.
> For legacy reasons implementations are likely to need to implement
> P256 and P384 for signature verification on certificates. However,
> there are significant advantages in speed and security for Edwards
> curves.
>
> I think it is high time to, 30 years after the invention of ECC, make
> it MTI in TLS. But I do not think it will be an immediately doable
> task.
>

Watson,

Thanks for kicking off this conversation.

As you no doubt know, TLS already specifies a number of ECC-based
cipher suites (RFC 4492 and following) and there are interoperable
implementations of many of these cipher suites. The two relevant questions
for the TLS WG seem to me to be:

- Should at least some of them be on the standards track rather than their
current Informational status.
- If we do standardize some ECC cipher suites, should we make one or
more of them an (the?) MTI.

The primary relevance of RFC 6090 to this conversation is that it may
clarify
the IPR situation and thus smooth the way to putting these ciphersuites on
Standards Track.

I have made https://github.com/tlswg/tls13-spec/issues/43 to track
this topic.

Best,
-Ekr