Subject: [Cfrg] FW: New Version Notification for draft-black-numscurves-00.txt

From: Brian LaMacchia <[email-masked]>
Date: Tue, 1 Jul 2014 17:13:11 +0000

Dear CFRG members,

I would like to draw your attention to the Internet-Draft draft-black-numscurves-00.txt, https://datatracker.ietf.org/doc/draft-black-numscurves/, which has just been submitted by Ben Black and the co-authors of [1].  This I-D contains the specification for the NUMS curves that Patrick Longa presented at the CFRG Spring 2014 Interim Meeting and which are implemented in the just-released Microsoft Research ECCLib  (see my message at http://www.ietf.org/mail-archive/web/cfrg/current/msg04602.html for that announcement).   For the reasons described both in the paper and the presentation at the Interim Meeting, I believe that it would be best for the CFRG to standardize a family of both Weierstrass and twisted Edwards curves generated through publicly verifiable means in order to meet the broad needs of the IETF.  

With the submission of this I-D and the release of MSR's open source implementation, I believe the feedback received at the Interim Meeting concerning the proposed NUMS curves has been successfully addressed and I encourage the CFRG to have a more detailed and thoughtful discussion of the various curve candidates that have been proposed.   The needs of the entire IETF in this space, starting with the TLS WG, seem like a very ripe topic for discussion at IETF-90 in Toronto.

					--bal

[1] Joppe W. Bos, Craig Costello, Patrick Longa and Michael Naehrig, “Selecting Elliptic Curves for Cryptography: An Efficiency and Security Analysis”, Cryptology ePrint Archive: Report 2014/130. Available at: http://eprint.iacr.org/2014/130

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Monday, June 30, 2014 11:17 PM
To: Joppe W.Bos; Craig Costello; Benjamin Black; Craig Costello; Joppe W. Bos; Patrick Longa Pierola; Michael Naehrig; Patrick Longa Pierola; Benjamin Black; Michael Naehrig
Subject: New Version Notification for draft-black-numscurves-00.txt

A new version of I-D, draft-black-numscurves-00.txt has been successfully submitted by Benjamin Black and posted to the IETF repository.

Name:		draft-black-numscurves
Revision:	00
Title:		Elliptic Curve Cryptography (ECC) Nothing Up My Sleeve (NUMS) Curves and Curve Generation
Document date:	2014-06-30
Group:		Individual Submission
Pages:		13
URL:            http://www.ietf.org/internet-drafts/draft-black-numscurves-00.txt
Status:         https://datatracker.ietf.org/doc/draft-black-numscurves/
Htmlized:       http://tools.ietf.org/html/draft-black-numscurves-00

Abstract:
   This memo describes a family of deterministically generated Nothing
   Up My Sleeve (NUMS) elliptic curves over prime fields offering high
   practical security in cryptographic applications, including Transport
   Layer Security (TLS) and X.509 certificates.  The domain parameters
   are defined for both classical Weierstrass curves, for compatibility
   with existing applications, and modern twisted Edwards curves,
   allowing further efficiency improvements for a given security level.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Brian LaMacchia <[email-masked]>
Date: Tue, 1 Jul 2014 20:37:37 +0000

>From: TLS [mailto:[email-masked]] On Behalf Of Watson Ladd
>Sent: Tuesday, July 01, 2014 11:08 AM
>To: [email-masked]
>Subject: Re: [TLS] [Cfrg] FW: New Version Notification for draft-black-numscurves-00.txt
>
>Is there any technical difference between 19 and 189 other then a slight change in square root calculations? 

Yes, there is.  For the NUMS curve, for each security level we
started with the largest prime smaller than 2^(security level)
congruent to 3 mod 4, which is why we use p = 2^256 - 189.  As
you point out, choosing a prime congruent to 3 mod 4 simplifies
the square root calculations, but it also means that for the
twisted Edwards curves we can find optimal cofactors of (4,4) for
the curve and its twist.  We do not expect to see significant
performance differences between modular operations implemented
with p = 2^256 -189 and p = 2^255 - 19 (the prime for
Curve25519).
 
An advantage of the NUMS construction approach is that we are
able to deterministically choose both a short Weierstrass and a
twisted Edwards curve over the same prime for the same security
level.  It seems to me that one of the questions the CFRG needs
to consider is the relative merits of the two curve types.  It's
not clear to me whether the performance improvements possible
using twisted Edwards curves outweigh the additional complexity
of moving existing codebases from short Weierstrass curves.

					--bal