Subject: [Cfrg] Alternatives to rigidity?

From: Tony Arcieri <[email-masked]>
Date: Wed, 31 Dec 2014 17:12:40 -0800

It seems the purpose of proposed "rigid" curve generation guidelines is to
produce so-called "nothing up my sleeve" curves, i.e. curves we are
confident haven't been tampered with to reduce security because we assume
we can create an algorithm to pick good curves.

However it seems there are differing opinions on what constitutes rigidity,
e.g. the Ben Black draft vs:

http://safecurves.cr.yp.to/rigid.html

Instead of trying to come up with constraints to generate curves de novo,
why not judge curves on the merits of how they were generated and what
known properties they hold? The SafeCurves web site lays out a rubric for
doing this:

http://safecurves.cr.yp.to/

Surely people would want to bikeshed this rubric, but isn't it a good start?

It also seems like the most important thing is producing a performant safe
curve. Some promising ones seem to be:

- Curve25519
- Ed448-Goldilocks
- Ilari's 2^389-21 curve

There are certainly others, but the above seem to perform well.

My take is that the CFRG is otherwise deadlocked, and the central issue
seems to be the trustworthiness of curves. However, at least as far as I
can gather from the crypto community, Curve25519 is widely accepted and
nobody (except Microsoft?) is questioning that.

There are certainly other questions like a signature algorithm, but even
there I think EdDSA is widely accepted, and performs well too.

I guess my main question is: does anyone else care about rigidity (as
defined by Ben Black) except Microsoft and if not, should the CFRG just
punt on it and pick some curves everyone else considers non-controversial?

-- 
Tony Arcieri

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 31 Dec 2014 18:49:53 -0800

> there I think EdDSA is widely accepted, and performs well too.

And if EdDSA vs ECDSA is an issue, perhaps consider using Ed25519 keys and
convert to Weierstrass to do ECDSA. No need for FrankenECDSA that way.

-- 
Tony Arcieri

---

From: Nico Williams <[email-masked]>
Date: Wed, 31 Dec 2014 21:01:03 -0600

> convert to Weierstrass to do ECDSA. No need for FrankenECDSA that way.

EdDSA is quite convincing and has some convenient advantages over ECDSA.
It'd be nice to see a complete treatment of it by CFRG.

Nico
--