Subject: [TLS] Obstacles to standardizing ECC in TLS

From: Watson Ladd <[email-masked]>
Date: Mon, 9 Jun 2014 18:40:03 -0300

Dear all,

While I think that ECC ciphersuites and some well chosen curves need
to be core, MTI features of TLS 1.3 for performance issues, I think
there a few issues that need to be addressed.

The first is that RFC 6090 is wrong: the formulas are incorrect, and
so it should not be cited.

The second is that the CFRG has not yet decided which curves to use.
For legacy reasons implementations are likely to need to implement
P256 and P384 for signature verification on certificates. However,
there are significant advantages in speed and security for Edwards
curves.

I think it is high time to, 30 years after the invention of ECC, make
it MTI in TLS. But I do not think it will be an immediately doable
task.

Sincerely,
Watson Ladd

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 9 Jun 2014 14:55:07 -0700

> it MTI in TLS. But I do not think it will be an immediately doable

Watson,

Thanks for kicking off this conversation.

As you no doubt know, TLS already specifies a number of ECC-based
cipher suites (RFC 4492 and following) and there are interoperable
implementations of many of these cipher suites. The two relevant questions
for the TLS WG seem to me to be:

- Should at least some of them be on the standards track rather than their
current Informational status.
- If we do standardize some ECC cipher suites, should we make one or
more of them an (the?) MTI.

The primary relevance of RFC 6090 to this conversation is that it may
clarify
the IPR situation and thus smooth the way to putting these ciphersuites on
Standards Track.

I have made https://github.com/tlswg/tls13-spec/issues/43 to track
this topic.

Best,
-Ekr

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 9 Jun 2014 21:55:23 -0400

> The second is that the CFRG has not yet decided which curves to use.

My recollection is that CFRG has picked 25519 as its (first perhaps) recommend curve.  Sean Turner, which my assist, owes an I-D based on the original paper.

	/r$

--  
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]; Twitter: RichSalz

---

From: Watson Ladd <[email-masked]>
Date: Tue, 10 Jun 2014 08:29:27 -0300

> My recollection is that CFRG has picked 25519 as its (first perhaps) recommend curve.  Sean Turner, which my assist, owes an I-D based on the original paper.

I thought this was the case also, but it's very unclear:
And the accepted curves extension indicates curves acceptable in
certificates, unless I am wildly off base, and we don't quite yet have
an ID for Ed25519, which we need for signatures. I would welcome
making 25519/Ed25519 MTI.

Sincerely,
Watson Ladd

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin