Re: [TLS] Using ECC Brainpool curves with TLS

[Douglas Stebila <[e-mail]>]

On 2012-Jul-6, at 6:43 PM, Johannes Merkle wrote:

> [Question 4] In RFC 5639, for each of the bit lengths 160, 192, 224, 256, 320, 384, 512 two curves are defined, one
> being the "quadratic twist" of the other having the same algebraic structure (and hence, security level), but one of
> them allows particular efficient arithmetic. In order to leave the choice of the curve for a given bit length to the
> implementation we propose to register IANA values (for EC Named Curve) for both curves for each bit length. Of course,
> this doubles the number of number assignments. Does anyone consider this a problem?

One alternative would be to use an extension, similar to the Supported Points Format Extension, to indicate whether to use the twisted form or the original form.  Or in fact define the twisted form as just another ECPointFormat.

But you could also ask the question: if the quadratic twist is more efficient, will anyone ever use the untwisted version?  If not, then perhaps you could just standardize the twisted version alone, reducing the number of combinations to be tested and supported.

Douglas