Subject: Re: [Cfrg] [TLS] Curve25519 draft

From: Watson Ladd <[email-masked]>
Date: Sun, 4 May 2014 17:52:05 -0700

On Sun, May 4, 2014 at 5:17 PM, Eric Rescorla <[email-masked]> wrote:
> On Sun, May 4, 2014 at 4:44 PM, Watson Ladd <[email-masked]> wrote:
>>
>> Dear all,
>> My impression of the CFRG meeting result was that Curve25519 was fine,
>> and that drafts describing it were going to be written this summer. In
>> TLS we can proceed with this draft it looks like.
>>
>> Am I misremembering/misunderstanding?
>
>
> My understanding was a bit more modest, namely that the CFRG intended
> to produce a recommendation by IETF Toronto and that Curve25519 was
> probably the leading contender for that recommendation at the 128-bit
> security level, but that they weren't quite ready to commit. So people were
> to go off and do drafts with an aim to have an answer by YYZ. Though
> perhaps I am the one who misunderstood.

Is this the blocking task? In other words, if the CFRG was to tomorrow
say "Curve25519 can be used" would we be ready to proceed to LC? I
feel like the answer is "maybe".

>
> In either case, as a matter of process I would expect (or at least hope)
> that
> the CFRG will send us some sort of formal statement of their recommendation
> so that we have something specific to refer to for future.

Well, what's the timeline/scope on this? I got an impression that the
document to be produced was an algorithm description, not just a list
of curves. Furthermore, we've not discussed signatures, (ECDSA has
issues with performance and batch verification, you need Ed25519, not
Curve25519 (well, for some variants of not)), so if we want one
document to address everything, that's going to be a few more
meetings, without really changing the impact for us.

Sincerely,
Watson Ladd
> -Ekr

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin