Subject: I-D Action:draft-ietf-pkix-ecc-subpubkeyinfo-00.txt

From: [email-masked]
Date: Wed, 05 Dec 2007 22:50:02 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

	Title           : Elliptic Curve Cryptography Subject Public Key Information
	Author(s)       : S. Turner, et al.
	Filename        : draft-ietf-pkix-ecc-subpubkeyinfo-00.txt
	Pages           : 19
	Date            : 2007-12-05

This document specifies the syntax and semantics for the Subject 
Public Key Information field in certificates that support Elliptic 
Curve Cryptography.  This document updates [RFC3279].

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-ecc-subpubkeyinfo-00.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of 
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then
	"get draft-ietf-pkix-ecc-subpubkeyinfo-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-pkix-ecc-subpubkeyinfo-00.txt".

NOTE:   The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: "Turner, Sean P." <[email-masked]>
Date: Thu, 6 Dec 2007 08:38:49 -0800

In this draft we made requirements statements about the choices available in
ECParameters. We used the K.I.S.S. principal in all cases. Making the
ecPublicKey a MUST was easy as well as picking the ECParameters choices. I
followed the same principal when I picked the SpecifiedCurve field options,
but they should be reviewed:
 - picked version 1
 - picked the prime-p over characteristic two
 - picked normal basis over trinomial and pentanomial

spt 

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] 
>Sent: Wednesday, December 05, 2007 7:50 PM
>To: [email-masked]
>Cc: [email-masked]
>Subject: I-D Action:draft-ietf-pkix-ecc-subpubkeyinfo-00.txt 
>
>This document specifies the syntax and semantics for the 
>Subject Public Key Information field in certificates that 
>support Elliptic Curve Cryptography.  This document updates [RFC3279].
>
>To remove yourself from the I-D Announcement list, send a 
>message to [email-masked] with the word 
>unsubscribe in the body of the message.
>Internet-Drafts are also available by anonymous FTP. Login 
>with the username "anonymous" and a password of your e-mail 
>address. After logging in, type "cd internet-drafts" and then
>http://www.ietf.org/shadow.html or 
>ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>	"FILE 
>/internet-drafts/draft-ietf-pkix-ecc-subpubkeyinfo-00.txt".
>
>Below is the data which will enable a MIME compliant mail 
>reader implementation to automatically retrieve the ASCII 
>version of the Internet-Draft.
>

---

From: "Kemp, David P." <[email-masked]>
Date: Thu, 6 Dec 2007 13:28:17 -0500

Section 2.1.1.2.1 of the new ECC I-D states:

   If version is ecdpVer2, then the curve and the base point
   G shall be generated verifiably at random, and curve.seed
   shall be present.

It seems quite peculiar to say that a value is generated "at random"
when the value has zero entropy (as is the case when a curve and base
point are generated by hashing a seed and the value of the seed is
known).  That's almost as peculiar as claiming that the well known
constant PI is random.

RFC 3797 Section 3 states:

   The crux of the unbiased nature of the selection is that it is based
   in an exact, predetermined fashion on random information which will
   be revealed in the future and thus can not be known to the person
   specifying the algorithm.

Unlike RFC 3797, the ECC I-D contains no recommendations concerning the
selection of random (unpredictable) values of curve.seed.  A CA that
wishes to manipulate the values of curve and G may have some
computational effort to determine a seed, but computation is possible
assuming that the pool of suitable manipulated values is not too sparse.

Please replace the phrase "generated verifiably at random" with
something like "generated deterministically" that does not imply that
there is some entropy/unpredictability involved in the process.

---

From: "Turner, Sean P." <[email-masked]>
Date: Sun, 16 Dec 2007 15:47:01 -0500

Dave,

Thanks for the review. The phrase you refer to actually appears more than
once. I'll replace it in all places as suggested.

spt 

>From: [email-masked] 
>[mailto:[email-masked]] On Behalf Of Kemp, David P.
>Sent: Thursday, December 06, 2007 1:28 PM
>To: [email-masked]
>Subject: What is "verifiably at random"??? (Was RE: I-D 
>Action:draft-ietf-pkix-ecc-subpubkeyinfo-00.txt)
>
>
>when the value has zero entropy (as is the case when a curve 
>and base point are generated by hashing a seed and the value 
>of the seed is known).  That's almost as peculiar as claiming 
>that the well known constant PI is random.
>
>
>Unlike RFC 3797, the ECC I-D contains no recommendations 
>concerning the selection of random (unpredictable) values of 
>curve.seed.  A CA that wishes to manipulate the values of 
>curve and G may have some computational effort to determine a 
>seed, but computation is possible assuming that the pool of 
>suitable manipulated values is not too sparse.
>
>Please replace the phrase "generated verifiably at random" 
>with something like "generated deterministically" that does 
>not imply that there is some entropy/unpredictability involved 
>in the process.
>

---

From: Bodo Moeller <[email-masked]>
Date: Mon, 17 Dec 2007 12:15:19 +0100

>> that the well known constant PI is random.
[...]

> once. I'll replace it in all places as suggested.

The phrase "verifiably at random" certainly is incorrect here and
"generated deterministically" arguably is correct.  However, the
latter isn't quite meaningful as it is not really saying what this is
supposed to say -- it misses the key idea.  The best way I know to
express the concept is saying that the values have been generated
"verifiably pseudorandomly".

We use a standardized procedure involving cryptographic hashes to
deterministically generate the values from a seed string so that
others can verify that the values have been generated properly.  They
may not be able to verify how we chose the seed, but still they have
some assurance that there is no hidden trapdoor, and more generally
that anything that is wrong with the particular value also is wrong
with a non-negligible fraction even of actually random values (thanks
to the assumed pseudorandomness of hash outputs).

Values that have been "generated deterministically" might have been
deterministically constructed specifically to contain a trapdoor;
at least, the term isn't saying anything to the contrary.  When
speaking of "verifiably pseudorandom" values, we stress that these
values are, in some sense, similar to random values (even though of
course they certainly are not actually random).

Bodo