Subject: [Uta] P-256

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Sat, 06 Dec 2014 19:20:23 -0700

Joe St. Sauver raised a concern about P-256:

     Also in 4.2.1, NIST P-256 (secp256r1) is called out for
     interoperability purposes. I get the intent, but I have concerns
     given the analysis reported near the bottom of
     http://safecurves.cr.yp.to/ for that (and related) curves.

The sense of the authors is that we don't know enough to move away from 
P-256 at this time, and that if evidence emerges for a better candidate 
then this recommendation could be modified in a BCP that replaces this 
document.

Naturally, if WG participants have concerns and we can settle on a 
better recommendation now, then the authors will incorporate the results 
of working group consensus.

Peter

-- 
Peter Saint-Andre
CTO @ &yet
https://andyet.com/

---

From: Watson Ladd <[email-masked]>
Date: Sat, 6 Dec 2014 18:42:53 -0800

On Sat, Dec 6, 2014 at 6:20 PM, Peter Saint-Andre - &yet
<[email-masked]> wrote:
> P-256 at this time, and that if evidence emerges for a better candidate then
> this recommendation could be modified in a BCP that replaces this document.

The problem is that there is no alternative with acceptable
performance that fixes the issues, that is widely deployed. Even if we
had a better alternative today, interop would still make P256 the
easiest choice, and the tyranny of the install base continues.

Of course, then one has to deal with updating all the software out there.
>
> Naturally, if WG participants have concerns and we can settle on a better
> recommendation now, then the authors will incorporate the results of working
> group consensus.

Can we just get this draft out the door? Some of the issues being
addressed are easily exploitable, recurring security issues.

Sincerely,
Watson Ladd

>
> Peter
>
> --
> Peter Saint-Andre
> CTO @ &yet
> https://andyet.com/
>
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Sat, 06 Dec 2014 19:46:01 -0700

On 12/6/14, 7:42 PM, Watson Ladd wrote:
> Can we just get this draft out the door?

You can be sure the authors desire that more fervently than anyone. 
However we are trying to do that without ignoring legitimate concerns. 
We are pushing to submit a revised I-D addressing all WGLC feedback as 
soon as possible.

Peter

-- 
Peter Saint-Andre
CTO @ &yet
https://andyet.com/

---

From: Benjamin Black <[email-masked]>
Date: Sat, 6 Dec 2014 18:53:41 -0800

As Watson says, the NIST curves are what we have. They are relatively slow
and difficult to implement correctly, but they work well enough today and
are best common practice. We will have other options in the future and when
they are broadly deployed the document can be changed.

On Saturday, December 6, 2014, Peter Saint-Andre - &yet <[email-masked]>
wrote:

>>> then
> However we are trying to do that without ignoring legitimate concerns. We
> are pushing to submit a revised I-D addressing all WGLC feedback as soon as
> possible.
>
> Peter
>
> --
> Peter Saint-Andre
> CTO @ &yet
> https://andyet.com/
>

---

From: Leif Johansson <[email-masked]>
Date: Sun, 07 Dec 2014 13:09:35 +0100

> of working group consensus.

I believe the CFRG is expected to come up with curve recommendations for
the IETF. I believe We should wait for them and decide if we want to
rev. the BCP at that time but this is one of those areas where I'd
like the sec area ADs to chime in.

	Cheers Leif

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 07 Dec 2014 14:32:19 +0000

Hiya,

> like the sec area ADs to chime in.

Sure. I'd say please produce the BCP now without waiting
on CFRG.

When CFRG are done, and when we see if their chosen
additional curves get deployed then it'll be time to see if
the generic UTA BCP ought or ought not be revised. (And
who knows if the UTA WG will still be about then or not.)

To repeat: please get this BCP done and out of the WG as
soon as possible. It is IMO overdue.

S.

---

From: Leif Johansson <[email-masked]>
Date: Sun, 07 Dec 2014 16:47:14 +0100

> soon as possible. It is IMO overdue.

Thx.

The WGLC has ended and the chairs are working on the writeup for the IESG.

It is always great to have a WG do this much review on a document but
there are other documents in UTA that would also benefit by some
attention (hint-hint, nundge-nudge)

	Cheers Leif

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Sun, 07 Dec 2014 11:16:58 -0700

> attention (hint-hint, nundge-nudge)

The authors have -08 very close to ready - we might be able to publish 
it tonight after I hear from my co-authors about a particular paragraph.

Peter