Subject: [Curdle] IETF time slot / next step for CURDLE

From: Daniel Migault <[email-masked]>
Date: Tue, 27 Jun 2017 12:46:08 +0000

Hi,

We will have a short session at the next IETF. In order to prepare the session we would like to understand if anyone would request a slot for presenting. If so, please let us know.

As we are close to have all our document sent to the IESG, we would like to understand if you see any future work items. Please provide any thoughts on the mailing list.

Yours,
Daniel and Rich

---

From: Russ Housley <[email-masked]>
Date: Tue, 27 Jun 2017 09:58:12 -0400

This is the status of my two documents:

 -- draft-ietf-curdle-cms-ecdh-new-curves — waiting to be put on the IESG telechat agenda

 -- draft-ietf-curdle-cms-eddsa-signatures — waiting for IETF Last Call

If the IESG or IETF Last Call raises an issue, then we can talk about it.  Nothing to say at this point.

Russ

> On Jun 27, 2017, at 8:46 AM, Daniel Migault <[email-masked]> wrote:
> 
> Hi, 
>  
> _______________________________________________
> Curdle mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/curdle <https://www.ietf.org/mailman/listinfo/curdle>

---

From: "Mark D. Baushke" <[email-masked]>
Date: Tue, 27 Jun 2017 08:26:03 -0700

Hi Daniel,

Daniel Migault <[email-masked]> writes:

> We will have a short session at the next IETF. In order to prepare the
> session we would like to understand if anyone would request a slot for
> presenting. If so, please let us know.

I will not be able to attend the IETF 99 in Prague.

> As we are close to have all our document sent to the IESG, we would
> like to understand if you see any future work items. Please provide
> any thoughts on the mailing list.

There are a number of expired and dead drafts that should probbly be
finished (ssh-ed25519, dnskey-ed25519, pkix-eddsa, pkix-newcurves).

I think some work on a better way to create Diffie-Hellman primes may
also be good to consider. There should be a way to use provable primes
that are not backdoored and do not leak bits due to using a generator
which does not generate a q-ordered subgroup. I would very much like to
see this used as long term we know that the use of fixed groups makes an
attractive target for precomputation.

To be fair, this group may also want to start looking at
Post-Qutanum-Cryptographic algorithms as well. Or, perhaps that will be
a new working group for the future.

	-- Mark

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 27 Jun 2017 16:20:39 +0000

> finished (ssh-ed25519, dnskey-ed25519, pkix-eddsa, pkix-newcurves).

Yes, probably.

> I think some work on a better way to create Diffie-Hellman primes may also
> be good to consider.

This might be a good thing to do, but I'd really prefer we create a new WG for it.  This one definitely has the history of "don't create, just update algorithms to use what was already specified."  I think that's a big change in mindset, and perhaps the participants, so I think a new group is better.

> To be fair, this group may also want to start looking at Post-Qutanum-
> Cryptographic

Same answer, same reason :)

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 27 Jun 2017 19:24:08 +0300

> finished (ssh-ed25519, dnskey-ed25519, pkix-eddsa, pkix-newcurves).

ssh-ed25519 actually seems dead, and I can't find any repacment
draft. Note, there are existing implementations here that could be
documented.

dnskey-ed25519 was superceded, replacement is RFC 8080.

pkix-eddsa and pkix-newcurves merged into pkix, currently sent to
IESG (what's up with that currently, last log entry is from beginnning
of may?).

> attractive target for precomputation.

Basically, there are no known bad primes for ECC except the too small
ones. However, the prime choice makes major impact on performance.
Therefore in most cases, the primes should be selected for performance.

The main problems with Edwards curves is cofactor of at least 4. That
may be problematic for some more exotic ECC algorithms (where just
clearing the cofactor doesn't work).  There are some rather clever
tricks for representations that behave like there is no cofactor.

The main advantages of Edwards curves is fast unified arithmetic, which
makes implementation in side-channel silent way reasonably easy.
Complete Edwards curves also map into complete Montgomery curves,
which are handy for implementing ECDH.

Then there is the two-edged sword of having the neutral point be like
other points. It is sure nice for side-channel silent implementations,
but can cause problems with some algorithms, especially in misuse
situations (CryptoNote recently had a security issue due to misuse of
Ed25519).

> a new working group for the future.

For PQC, I think most that should be done in this group is integration
tests (for discovering hidden problems with things like message sizes).
Those are at most experimential with extra warnings that there is very
little evidence that the algorithm is any good, and should not be
implemented except for testing.

-Ilari