Subject: [TLS] Curve25519 draft

From: Watson Ladd <[email-masked]>
Date: Sun, 4 May 2014 16:44:11 -0700

Dear all,
My impression of the CFRG meeting result was that Curve25519 was fine,
and that drafts describing it were going to be written this summer. In
TLS we can proceed with this draft it looks like.

Am I misremembering/misunderstanding?

Sincerely,
Watson Ladd

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 4 May 2014 17:17:40 -0700

> Am I misremembering/misunderstanding?

My understanding was a bit more modest, namely that the CFRG intended
to produce a recommendation by IETF Toronto and that Curve25519 was
probably the leading contender for that recommendation at the 128-bit
security level, but that they weren't quite ready to commit. So people were
to go off and do drafts with an aim to have an answer by YYZ. Though
perhaps I am the one who misunderstood.

In either case, as a matter of process I would expect (or at least hope)
that
the CFRG will send us some sort of formal statement of their recommendation
so that we have something specific to refer to for future.

-Ekr

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 4 May 2014 17:45:25 -0700

> perhaps I am the one who misunderstood.

I think you probably were. The way I remember it was that Dave McGrew asked if anyone had any objections to Curve25519 being the single curve proposal to the IETF, and there were crickets. I didn't hear any suggestion that CRFG would make any actual "recommendation".

> In either case, as a matter of process I would expect (or at least hope) that

Even if they wanted to, it is still unclear to me how such a thing would happen formally. If it isn't going to happen formally, there is no reason to bother trying to force it.

To me, this means that anyone who cares about Curve25519 for TLS or IPsec or S/MIME or SSH should go ahead and start writing drafts. If somehow the CRFG comes to a different conclusion, you might need to stop.

--Paul Hoffman

---

From: Watson Ladd <[email-masked]>
Date: Sun, 4 May 2014 17:52:05 -0700

> perhaps I am the one who misunderstood.

Is this the blocking task? In other words, if the CFRG was to tomorrow
say "Curve25519 can be used" would we be ready to proceed to LC? I
feel like the answer is "maybe".

> so that we have something specific to refer to for future.

Well, what's the timeline/scope on this? I got an impression that the
document to be produced was an algorithm description, not just a list
of curves. Furthermore, we've not discussed signatures, (ECDSA has
issues with performance and batch verification, you need Ed25519, not
Curve25519 (well, for some variants of not)), so if we want one
document to address everything, that's going to be a few more
meetings, without really changing the impact for us.

Sincerely,
Watson Ladd

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 4 May 2014 17:52:20 -0700

On Sun, May 4, 2014 at 5:45 PM, Paul Hoffman <[email-masked]> wrote:

> I think you probably were. The way I remember it was that Dave McGrew
> asked if anyone had any objections to Curve25519 being the single curve
> proposal to the IETF, and there were crickets. I didn't hear any suggestion
> that CRFG would make any actual "recommendation".

If so that makes me sad. I thought the premise of the CFRG curve
effort was that they were going to make a recommendation. The
TLS chairs will reach out to the CFRG chairs and try to get some
clarity on what they propose to do.

-Ekr

> Even if they wanted to, it is still unclear to me how such a thing would
> happen formally. If it isn't going to happen formally, there is no reason
> to bother trying to force it.
> To me, this means that anyone who cares about Curve25519 for TLS or IPsec
> or S/MIME or SSH should go ahead and start writing drafts. If somehow the
> CRFG comes to a different conclusion, you might need to stop.
>
> --Paul Hoffman

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 4 May 2014 21:45:14 -0400

My recollection is that since there were no objections, Sean was going to write a doc, I would help and Tanja would review it and it would enough implementation and security background to be *the* recommendation.

--
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]<mailto:[email-masked]>; Twitter: RichSalz

---

From: Watson Ladd <[email-masked]>
Date: Sun, 4 May 2014 20:20:09 -0700

On Sun, May 4, 2014 at 6:45 PM, Salz, Rich <[email-masked]> wrote:
> My recollection is that since there were no objections, Sean was going to
> write a doc, I would help and Tanja would review it and it would enough
> implementation and security background to be *the* recommendation.

Yes, that's my impression also. So is there any reason to wait for
that doc to come out before proceeding with the 25519 in TLS draft?

Sincerely,
Watson Ladd
> IM: [email-masked]; Twitter: RichSalz
>
>
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>