Subject: [Cfrg] Recommending secp256k1 in FIPS 186-5

From: Dan Burnett <[email-masked]>
Date: Thu, 19 Dec 2019 10:29:54 -0500

Hello,

I have been a participant in several IETF Working Groups over the
years, most recently RTCWEB (and W3C's WebRTC), but not this RG in
particular.  However, I frequently recommend this group as highly
knowledgeable when it comes to wise choices in cryptographic
recommendations.  I learn something new every time I sit in on this group's
sessions at IETF meetings.

As mentioned in another thread, NIST is seeking feedback on their
recently-released draft of FIPS 186-5. [1]
My company and others are concerned about the lack of endorsement for
secp256k1 in this standard and have drafted a request for its addition.[2]
We would welcome any comments and/or support from this group and/or any of
its members (directly in the Google Doc linked below).  All comments are
welcome, including those arguing against this request :)

Thanks,

Dan Burnett
ConsenSys

[1]
https://www.federalregister.gov/documents/2019/10/31/2019-23742/request-for-comments-on-fips-186-5-and-sp-800-186
[2]
https://docs.google.com/document/d/1wygRHPMGhhanDev7iZSn_AlXw6FZdTK-cIh4fXD77jk/edit#heading=h.1xljt59f35x5

---

From: Tony Arcieri <[email-masked]>
Date: Thu, 19 Dec 2019 09:03:07 -0800

> welcome, including those arguing against this request :)

Unless I'm mistaken, no IETF protocols use secp256k1 either, nor has the
CFRG ever recommended it.

-- 
Tony Arcieri

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 19 Dec 2019 17:05:44 +0000

On Thu, Dec 19, 2019 at 7:30 AM Dan Burnett <daniel.burnett@consensys..net> wrote:

 My company and others are concerned about the lack of endorsement for secp256k1 in this standard and have drafted a request for its addition.[2]  We  would welcome any comments and/or support from this group and/or any of its members (directly in the Google Doc linked below).  All comments are welcome, including those arguing against this request :)

Unless I'm mistaken, no IETF protocols use secp256k1 either, nor has the CFRG ever recommended it.

And there’s no reason that I can see to add such a recommendation.

---

From: Scott Arciszewski <[email-masked]>
Date: Thu, 19 Dec 2019 12:07:36 -0500

I also oppose its recommendation.

On Thu, Dec 19, 2019, 12:06 PM Blumenthal, Uri - 0553 - MITLL <
[email-masked]> wrote:

> On Thu, Dec 19, 2019 at 7:30 AM Dan Burnett <daniel.burnett@consensys..net
> <[email-masked]>> wrote:
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Jeff Burdges <[email-masked]>
Date: Thu, 19 Dec 2019 18:13:59 +0100

At the high level, there is a good summary of this conversation at  https://safecurves.cr.yp.to  but three key points:

First, secp256k1’s usage in bitcoin and ethereum provides no reason to recommend its use elsewhere.

Second, existing recommendations for curves like P256 provides no reason to recommend additional other less than perfect curves.  In fact, I’d hope future discussions turned towards revoking existing recommendations, like P256, and replacing them with more modern alternatives like Decaf/Ristretto, and curves with more utility, like ZCash’s JubJub.

Third, there are many poorly designed, or outright insecure, protocols like SECIO are built on secp256k1 whose usage should not be encouraged.  Any recommendation for secp256k1 makes these protocols might encourage their usage.  We should also be wary of nasty interactions between existing secp256k1 protocols like BIP32 and ECDSA multisigs.

It’s possible that secp256k1 might become more interesting if any future protocols exploit its mirror curve, but this does not sound like a reason for recommending it now.  I think Blockstream put serious effort into exploiting this, but I’m not sure if anything really emerged.

Best,
Jeff

> On 19 Dec 2019, at 16:29, Dan Burnett <[email-masked]> wrote:
> 
> Hello,
> 
> I have been a participant in several IETF Working Groups over the years, most recently RTCWEB (and W3C's WebRTC), but not this RG in particular.  However, I frequently recommend this group as highly knowledgeable when it comes to wise choices in cryptographic recommendations.  I learn something new every time I sit in on this group's sessions at IETF meetings.
> 
> As mentioned in another thread, NIST is seeking feedback on their recently-released draft of FIPS 186-5. [1]
> [1] https://www..federalregister.gov/documents/2019/10/31/2019-23742/request-for-comments-on-fips-186-5-and-sp-800-186
> [2] https://docs.google.com/document/d/1wygRHPMGhhanDev7iZSn_AlXw6FZdTK-cIh4fXD77jk/edit#heading=h.1xljt59f35x5
>

---

From: Neil Madden <[email-masked]>
Date: Thu, 19 Dec 2019 17:56:09 +0000

> Unless I'm mistaken, no IETF protocols use secp256k1 either, nor has the CFRG ever recommended it.

But see https://datatracker.ietf.org/doc/draft-ietf-cose-webauthn-algorithms/ ...

Neil

---

From: Tony Arcieri <[email-masked]>
Date: Thu, 19 Dec 2019 10:01:54 -0800

On Thu, Dec 19, 2019 at 9:56 AM Neil Madden <[email-masked]> wrote:

> But see
> https://datatracker.ietf.org/doc/draft-ietf-cose-webauthn-algorithms/ ...
>

I can't say I think too highly of a draft dated November 1st, 2019 which is
recommending only RSASSA PKCS#1v1.5 and ECDSA w\ secp256k1.

Especially in the case of the former this seems unwise given the lingering
history of BB'06 (which continues to cause real-world breakages... there
was a BlackHat talk about it this year
<https://i.blackhat.com/USA-19/Wednesday/us-19-Chau-A-Decade-After-Bleichenbacher-06-RSA-Signature-Forgery-Still-Works-wp.pdf>
)

-- 
Tony Arcieri

---

From: Neil Madden <[email-masked]>
Date: Thu, 19 Dec 2019 19:10:26 +0000

>> On 19 Dec 2019, at 18:02, Tony Arcieri <[email-masked]> wrote:
> 
> I can't say I think too highly of a draft dated November 1st, 2019 which is recommending only RSASSA PKCS#1v1.5 and ECDSA w\ secp256k1.
> 
> Especially in the case of the former this seems unwise given the lingering history of BB'06 (which continues to cause real-world breakages... there was a BlackHat talk about it this year)

Indeed. As I understand it that draft is registering algorithm identifiers already in use by WebAuthn/FIDO (TPM attestation I believe) and the RSA ones are all explicitly marked as non-recommended or immediately deprecated.

However, secp256k1 *is* currently marked as recommended in that draft. For signature use only; I managed to get explicitly wording added not recommending it for ECIES/“ECDH-ES” encryption, but I’m not aware of any specific weakness for ECDSA use so I didn’t argue against it for that. If there are concerns for signature use then it’d be good to raise them with the COSE WG now. 

(I had a brief look at that draft when it was brought to my attention as it also registers JOSE algorithms, which might impact my employer. I’ve not followed either that draft or the COSE WG very much since so I don’t know much about it beyond what is in the draft itself).

— Neil

---

From: Jim Schaad <[email-masked]>
Date: Thu, 19 Dec 2019 11:18:37 -0800

From: Cfrg <[email-masked]> On Behalf Of Neil Madden
Sent: Thursday, December 19, 2019 9:56 AM
To: Tony Arcieri <[email-masked]>
Cc: CFRG <[email-masked]>
Subject: Re: [Cfrg] Recommending secp256k1 in FIPS 186-5

On 19 Dec 2019, at 17:03, Tony Arcieri <[email-masked] <mailto:[email-masked]> > wrote:

On Thu, Dec 19, 2019 at 7:30 AM Dan Burnett <daniel.burnett@consensys..net <mailto:[email-masked]> > wrote:

[JLS] This is being done for a W3C protocol and not for an IETF protocol.  There was some pushback from me at least to see if this was really necessary.  It is being marked as NOT RECOMMENDED by the IETF.

Jim

Neil

---

From: Jeff Burdges <[email-masked]>
Date: Sat, 21 Dec 2019 01:31:18 +0100

> On 19 Dec 2019, at 18:13, Jeff Burdges <[email-masked]> wrote:

I neglected to mention that secp256k1 has many really bad implementations for the curve itself, which invites different problems from all the bad protocols.

Jeff