Subject: Re: [Cfrg] ECC mod 8^91+5

From: Dan Brown <[email-masked]>
Date: Mon, 16 Oct 2017 15:08:16 +0000

Hi CFRG,

For those still interested, I've uploaded an Internet-Draft on ECC on 2y^2=x^3+x/GF(8^91+5):

https://tools.ietf.org/html/draft-brown-ec-2y2-x3-x-mod-8-to-91-plus-5-00
https://datatracker.ietf.org/doc/draft-brown-ec-2y2-x3-x-mod-8-to-91-plus-5/

It is very much a work-in-progress, maybe more so than a typical I-D.  

If I have incorporated some CFRG list comments into the draft, then I hope to properly acknowledge in the next update.

The main point of this curve is to use it in a system of multiply-applied diverse crypto, where its security features (special CM curve, minimal room for trapdoor) could complement those of other crypto algorithms (including PQC and other ECC algorithms).  Using this variant of ECC as the sole (PK) crypto would be risky (due to lack of track-record/aegis/scrutiny/etc.).

If the IETF and CFRG intend to generally pursue and encourage support of multiply-applied diverse crypto, at least where it is affordable (in the higher user-to-user network layers?), then I would ask the CFRG to consider this I-D as a work item.  Otherwise, maybe this I-D should stay on the individual submission stream.   

Best regards,

Dan

-----Original Message-----
From: Dan Brown 
Sent: Tuesday, May 16, 2017 1:36 PM
To: [email-masked]
Subject: ECC mod 8^91+5

Hi all,

I'm considering writing an I-D on doing ECC over the field of size
   8^91+5    (=2^273+5),
because it:
...

For ECC with this field, I am also considering the special curve
   2y^2=x^3+x,
because it:
...

---

From: Hanno Böck <[email-masked]>
Date: Sat, 21 Oct 2017 20:03:21 +0200

On Mon, 16 Oct 2017 15:08:16 +0000
Dan Brown <[email-masked]> wrote:

> The main point of this curve is to use it in a system of
> multiply-applied diverse crypto, where its security features (special
> CM curve, minimal room for trapdoor) could complement those of other
> crypto algorithms (including PQC and other ECC algorithms).  Using
> this variant of ECC as the sole (PK) crypto would be risky (due to
> lack of track-record/aegis/scrutiny/etc.).

People rarely do multi-crypto these days, and if they do they usually
have good reasons.
I don't see those reasons here.

As we all remember we had a very lengthy discussion about new ECC
curves not so long ago. New curves were standardized with what many
people consider desirable security properties.

As you indicate some people want to combine that with pqc. In this case
multi-crypto makes sense, because it can give you something that you
can't have in a single algorithm: well-tested crypto and postquantum
crypto.

But standardizing yet another new ecc method seems a rather obscure
threat scenario. You'd assume that you use multiple ECC methods and
there's a security flaw that affects all others, but not your new
curve.

If you feel you want multiple different standardized ECC methods you can
already use nist ecc + c25519 in combination. I'm not aware that anyone
is doing this.

In general I feel it's not desirable to have as many standardized
algorithms as possible, as it only complicates algorithm choices. A new
algorithm should always have good reasoning for its existence.

Therefore I'm against standardizing this unless further arguments are
brought up why it's advantageous compared to existing standardized ecc
schemes.

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: [email-masked]
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 21 Oct 2017 22:06:50 +0000

At first I was opposed, until I read Hanno’s note.  CFRG doesn’t do standardization, it would be up for some other WG to pick this up and use it.  I don’t think it’s likely, but that’s not for CFRG to decide, is it?

On the other hand, I still don’t see why, but if someone wants to do research via CFRG I don’t see why not.