Re: [TLS] Using Brainpool curves in TLS

On Tue, Oct 15, 2013 at 5:13 AM, Paul Bakker <p.j.bakker@offspark.com> wrote:
> Fresh from the oven:
> https://polarssl.org/tech-updates/releases/polarssl-1.3.1-released
>
> So: yes.. ;)
>
>> -----Original Message-----
>> From: tls-bounces@ietf.org [mailto:tls-bounces@ietf.org] On Behalf Of
>> Patrick Pelletier
>> Sent: dinsdag 15 oktober 2013 9:33
>> To: TLS@ietf.org (tls@ietf.org)
>> Subject: Re: [TLS] Using Brainpool curves in TLS
>>
>> On 10/14/13 8:45 AM, Johannes Merkle wrote:
>> > jaust in case that someone hasn't noticed it: our draft on using the
>> > Brainpool curves in TLS has been published as RFC 7027
>> > http://www.rfc-editor.org/rfc/rfc7027.txt
>>
>> Is support available in any TLS libraries yet?  Do we know which libraries
> are
>> planning on adding support for Brainpool?

What problems does this solve? The Brainpool curves still have
unverifiable construction, Weirstrauß form (meaning many corner cases
in addition and the possibility of sending points not on the curve),
primes that are ugly and horribly slow (seriously, randomly picked
primes?),
come courtesy of our friends in the BND, and don't solve any problems
beyond a possible backdoor in NIST curves. What is the rationale
behind these curves as opposed to Curve25519? (The curve given by the
Montgomery equation y^2=x^3+486662x^2+x over the field
F(2^255-19), with canonical basepoint x=9).

The implementation in PolarSSL has a nonconstant pattern of memory
access. Seriously, it isn't 1999 anymore: everyone doing cryptography
should be aware of these issues.
Sincerely,
Watson Ladd

>>
>> --Patrick
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin