Subject: Re: [Curdle] Multiple choices and authentication-only

From: Simon Josefsson <[email-masked]>
Date: Tue, 01 Mar 2016 10:47:49 +0100

"Paul Hoffman" <[email-masked]> writes:

> Some of the drafts proposed here are for algorithms that are only for
> authentication. If we have two options for those, "strong" and
> "stronger", essentially no one will choose "strong" because they would
> look "weak" doing so even if the authentication they need is
> completely satisfied by "strong". So we are in essence telling people
> "to look secure, you should always use 'stronger'".
>
> Fortunately, for EC, the message size and signing/verifying time is
> not a big issue, particularly because in most protocols these will
> (still!) be replacing RSA authentication. However, having two sizes
> means more operational complexity because each signer needs to decide
> (without enough guidance) which size to use.
>
> If you truly believe that 128 bit work factor is not sufficient for a
> particular IETF protocol, it would be good for this WG to hear
> why. "Because the NSA uses it for 'top secret' which most of us don't
> even know the definition of" isn't sufficient for me, but it might be
> for others.

+1

I believe 25519 is sufficient for IETF protocols, and I haven't seen any
strong technical arguments for anything else.  The hedge aspect has some
merit, but the cost of adding 448 to some protocols is really large
compared to the small gain we get from having a hedge variant available.

Complicating things with 448 was a CFRG political compromise to allow
things to move forward, in my perception.  There is no need to repeat
the same mistake for all protocols.

/Simon