Subject: [Cfrg] Is draft-agl-cfrgcurve-00 incompatible with Ed25519?

From: Tony Arcieri <[email-masked]>
Date: Fri, 9 Jan 2015 15:10:37 -0800

It would be good to get a definitive answer on this question before
draft-agl-cfrgcurve-00 adopted (which I'm guessing is likely to happen)

For clarity: I like draft-agl-cfrgcurve-00 and I hope it does get adopted.
I would simply like the CFRG to have the option to adopt Ed25519 in the
future. I am not necessarily saying the CFRG *should* adopt Ed25519
wholesale. However I would like for the CFRG to specifically address this
question in advance in anticipation of it coming up in the future.

If Ed25519 is incompatible with draft-agl-cfrgcurve-00, I would suggest
that drafg-agl-cfrgcurve-00 be specifically amended to include the
possibility of using Ed25519 for signatures in the future.

Ed25519 is already being deployed in SSH and OpenPGP contexts, so I hope
the CFRG would not accidentally rule it out in the name of "compromise".
Having similar-but-incompatible Edwards curves used in different protocol
contexts sounds like a recipe for disaster.

--
Tony Arcieri

---

From: Adam Langley <[email-masked]>
Date: Fri, 9 Jan 2015 15:15:40 -0800

> draft-agl-cfrgcurve-00 adopted (which I'm guessing is likely to happen)

The Edwards curve recommended in draft-agl-cfrgcurve-00 is the curve
behind Ed25519. The draft doesn't say anything about EdDSA, or even
signatures, but I don't think there's an incompatibility—just an
incompleteness.

Cheers

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org

---

From: Tony Arcieri <[email-masked]>
Date: Fri, 9 Jan 2015 15:17:06 -0800

> signatures, but I don't think there's an incompatibility—just an

EdDSA is a separate can of worms. In the worst case, if Ed25519 public keys
are used, then ECDSA can be used by doing point conversion from Edwards to
Weierstrass. Or perhaps "FrankenECDSA"... but that would be
less-than-ideam, IMO.

I am more specifically concerned about the curve itself, not the signature
algorithm.

-- 
Tony Arcieri