Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

[Stephen Farrell <[e-mail]>]

Hiya,

On 26/06/14 23:10, Eric Rescorla wrote:
> Also, this seems like a bigger topic than TLS. Perhaps the
> AD should sponsor a discussion in SAAG?

Yes, this is not TLS specific, though its probably not really
possible to have no discussion of it here since TLS is likely
the first large "customer" for 25519 in the IETF, if the WG
choose to go that route.

CFRG is definitely a better location for any detailed crypto
discussion, i.e. for all algorithm internals. As noted before
there was no indication from CFRG at the interim that 25519
is problematic. That's not quite as ringing an endorsement
as has been represented here, but I figure cryptographers are
going to be like lawyers for this  - they'll never all agree
an algorithm/curve is perfect;-) So its also possible CFRG
might come up with more curves that they also like and that's
fine. If someone wants more curves generated, CFRG is the
place to chat about that and not here.

But at that interim 25519 was definitely considered ok for
use in IETF protocols - there was no dissent when I (more
than once) directly asked that question and said that I
wanted to hear dissent should there be any. The proximate
cause for my question was allocating a codepoint for ed25519
for ssh, which has happened and the associated draft has
completed IETF LC, also without any criticism of the use
of 25519. I'm waiting for an updated I-D on that before
putting it on an IESG telechat for approval, but my reading
of the IETC LC was that there were no cryptographic issues
raised at all. That IETF LC is also evidence that the IETF
consider 25519 is ok. That said, when/if TLS decide to use
it, I expect there'll be more interest in the IETF LC for
that, so we'll see what happens then.

For now anyway, my interpretation is that we don't have any
cryptographic (nor declared IPR) reason to not use 25519 if a
WG choose to want it. However, there is some more work to be
done to document that so it can be used by WGs. I think that's
being done by CFRG though, but if not, or if there are more
generic bits that need discussion then saag seems like a fine
list for that. If you think such a discussion on saag is needed
then please ping me offlist to explain exactly what we need
to discuss there (since I'm not clear about that). In the
meanwhile most of this thread does seem to me to better belong
on the CFRG list and is basically a distraction for TLS.

Also, I have to say the language in Mike's original mail was,
at best, unfortunate, e.g. "small but vocal minority agitating"
is not likely to kick off a calm reasoned debate, and is
definitely not going to help the TLS WG keep focused on its
work so I really hope folks don't respond in kind, and if the
chairs want to loudly stomp on threads with such language
(regardless of source and mostly regardless of topic) they
have my full backing.

Cheers,
S.