Re: [TLS] Additional Elliptic Curves (Curve25519 etc) for TLS ECDH key agreement

[Robert Ransom <[e-mail]>]

On 1/11/14, Dr Stephen Henson <[e-mail]> wrote:
> On 11/01/2014 16:32, Simon Josefsson wrote:
>>
>> 2) Does description of private/public key representation and computation
>>    of shared secret belong in draft-josefsson-tls-curve25519?  It has to
>>    be somewhere, I believ, but possibly this could go into
>>    draft-ladd-safecurves, or some other generic document, unless there
>>    are TLS-specific aspects.  Insight into this would be appreciated.
>>
>
> A comment on the following paragraph:
>
>    This document only describes usage of additional curves for ephemeral
>    key exchange (ECDHE), not for use with long-term keys embedded in
>    PKIX certificates (ECDH_ECDSA and ECDH_ECDSA).  This is because
>    Curve25519 is not directly suitable for authentication with ECDSA,
>    and thus not applicable for signing of e.g.  PKIX certificates.  See
>    draft-josefsson-eddsa-ed25519 for a parallel effort.
>
> Although the curves are not directly suitable for authentication this
> doesn't
> actually matter because the certificate doesn't have to be signed using the
> same
> curve or indeed the same algorithm.

Montgomery and Edwards curves can easily be used for signature schemes
(remember that “authentication” can refer to protocols other than
signatures).  The problem with using them in ECDSA is that ECDSA is
specified in terms of curves in short-Weierstrass form, and having to
map these curves to short-Weierstrass form would be ugly.  Dr.
Bernstein's EdDSA is even worse: it prohibits every curve that Dr.
Bernstein himself has specified since Curve25519.

It would be easy for a competent author to specify a signature scheme
which doesn't constrain the point formats that it uses.  Feng Hao's
I-D specifying Schnorr proofs of knowledge could be used as a starting
point for this.


Robert Ransom