Re: [TLS] Should we require compressed points

On 10/21/2014 11:01 AM, Hubert Kario wrote:
> ------------------------------------------------------------------------
>
>     *From: *"Eric Rescorla" <ekr@rtfm.com>
>     *To: *tls@ietf.org
>     *Sent: *Tuesday, 21 October, 2014 4:52:29 PM
>     *Subject: *[TLS] Should we require compressed points
>
>     https://github.com/tlswg/tls13-spec/issues/80
>
>     Today we discussed the possibility of requiring support for
>     compressed points
>     in TLS 1.3 now that the IPR has expired.
>
>     Specifically, I propose that for TLS 1.3, we:
>
>     - Use only compressed points for the existing curves (and presumably
>       whatever superior format is defined for the CFRG-recommended
>       curves, as appropriate).
>
>     - Deprecate the Supported Point Formats extension for TLS 1.3
>
>
>     For RFC 4492-bis, we might also consider requiring support for
>     compressed
>     points as well as uncompressed (already required) but this seems
>     like a
>     separable issue, since it's mostly in service of optimization
>     rather than
>     simplicity.
>
>
> How does that impact possibility of adding more "exotic" curves like 
> curve25519/Ed25519
> in some later point in time?

My personal opinion is that there needs to be a complete separation in 
encodings and code points between X9.63 compliant EC data and anything 
else.

In the specific case of the curves you mention, unlike X9.63 curves, 
signing curves/keys and key agreement curves/keys are not 
interchangeable or compatible.  They are actually two different crypto 
systems and will probably require different code points  and maybe 
encodings.

The other classes of curves that don't have an X9.63 (Montgomery?) 
representation will need similar treatment.

Mike

> -- 
> Regards,
> Hubert Kario
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls