Subject: [Lwip] Fwd: New Version Notification for draft-ietf-lwig-curve-representations-23.txt

From: Rene Struik <[email-masked]>
Date: Fri, 21 Jan 2022 18:32:37 -0500

Dear colleagues:

I updated the lwig curve draft, so as to take into account (1) another 
crypto review panel review this draft was subjected to by the powers 
that be; (2) discussions on ECDSA with the SHA3 family hash functions 
that took place on the COSE mailing list and offline Nov-early January.

Changes:

a) Section 7 (Implementation Status): included reference to ANSSI's 
(French information security agency) use of lwig curve draft, including 
motivations (hooray);

b) Appendix B.1 (Elliptic Curve Nomenclature): made definition of 
isomorphic curves in Appendix B.1 more precise, via one-sentence change 
(zero impact on draft, but done for completeness);

c) Appendix I (Data Conversions): added Definition of ASCII symbols 
(with reference to RFC 20);

d) Appendix Q (ECDSA): corrected numerical examples for ECDSA w/ 
Wei25519 and SHAKE-128 (Appendix Q.3.2) and ECDSA w/ Wei448 and 
SHAKE-256 (Appendix Q.3.3). Here, it turned out that the Python code in 
Sage that I used incorrectly implements the FIPS 202 specification of 
SHAKE128 and SHAKE256. To do this properly, I implemented all SHA3 
functions from scratch on the bit-level and had this vetted 
independently via contacts at NIST. To indicate that ECDSA w/ Wei448 and 
SHAKE256 uses FIPS 202-conformant SHAKE256, I added in Section 4.3 as 
reference to FIPS 202 "see Section 6.3 of [FIPS 202]"). BTW - adding 
ASCII (point c) above) above was motivated by desire to avoid 
bit/byte-ordering ambiguity and set the record straight.

I made a few (very few) typographical and cosmetic changes throughout 
the document, in an attempt to make the crypto review panel reviewer 
happy. (Time will tell.)

I hope this helps.

Best regards, Rene

-------- Forwarded Message --------
Subject: 	New Version Notification for 
draft-ietf-lwig-curve-representations-23.txt
Date: 	Fri, 21 Jan 2022 14:56:26 -0800
From: 	[email-masked]
To: 	Rene Struik <[email-masked]>

A new version of I-D, draft-ietf-lwig-curve-representations-23.txt
has been successfully submitted by Rene Struik and posted to the
IETF repository.

Name: draft-ietf-lwig-curve-representations
Revision: 23
Title: Alternative Elliptic Curve Representations
Document date: 2022-01-21
Group: lwig
Pages: 150
URL: 
https://www.ietf.org/archive/id/draft-ietf-lwig-curve-representations-23.txt
Status: 
https://datatracker.ietf.org/doc/draft-ietf-lwig-curve-representations/
Htmlized: 
https://datatracker.ietf.org/doc/html/draft-ietf-lwig-curve-representations
Diff: 
https://www.ietf.org/rfcdiff?url2=draft-ietf-lwig-curve-representations-23

Abstract:
This document specifies how to represent Montgomery curves and
(twisted) Edwards curves as curves in short-Weierstrass form and
illustrates how this can be used to carry out elliptic curve
computations leveraging existing implementations and specifications
of, e.g., ECDSA and ECDH using NIST prime curves. We also provide
extensive background material that may be useful for implementers of
elliptic curve cryptography.

The IETF Secretariat

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 22 Jan 2022 08:12:32 +0100

Hi Rene,

thank you for doing this work.

One question comes to mind:

> On 22. Jan 2022, at 00:32, Rene Struik <[email-masked]> wrote:
> 
> I implemented all SHA3 functions from scratch on the bit-level and had this vetted independently via contacts at NIST.

Is this implementation available?  
Has it been upstreamed to Sage?

Grüße, Carsten

---

From: Rene Struik <[email-masked]>
Date: Tue, 25 Jan 2022 09:29:44 -0500

Hi Carsten:

Thanks for the support.

One can download my Sage code, some conversion functions, and examples 
via the link below. The conversion functions follow Appendix I of the 
lwig curve draft.

Please contact me *offline* if you wish to discuss.

Rene

https://cocalc.com/6ba84e72-ce88-42f7-8c90-21e04e3fe757/raw/ietf/fips202material/fips202spec+conversion+examples.zip

On 2022-01-22 2:12 a.m., Carsten Bormann wrote:
>> On 22. Jan 2022, at 00:32, Rene Struik<[email-masked]>  wrote:
>>

-- 
email:[email-masked]  | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 287-3867

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 25 Jan 2022 09:22:50 -0600

Hi Rene,

What is sha3?

What happened to sha2? Is sha2 out now?

Why do we need a new sha every now and then?

Behcet

On Tue, Jan 25, 2022 at 8:30 AM Rene Struik <[email-masked]> wrote:

> Hi Carsten:
>
> Thanks for the support.
>
> One can download my Sage code, some conversion functions, and examples via
> the link below. The conversion functions follow Appendix I of the lwig
> curve draft.
>
> On 22. Jan 2022, at 00:32, Rene Struik <[email-masked]> <[email-masked]> wrote:
>
> email: [email-masked] | Skype: rstruik
> _______________________________________________
> Lwip mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lwip
>

---

From: Rene Struik <[email-masked]>
Date: Tue, 25 Jan 2022 10:29:03 -0500

Hi Behcet:

I think it carries a little bit too far to try and discuss algorithm 
agility considerations on this list (here, with SHA-2 hash function 
family vs. SHA-3). Please see [1] and info on the so-called SHA3 hash 
function contest (which ran from ~2009 to 2013) one can find online and 
in [1] itself.

I hope this helps you navigate this.

Rene

Ref: [1] FIPS Pub 202 - SHA-3 Standard - Permutation-Based Hash and 
Extendable Output Functions (August 6, 2015). See 
https://csrc.nist.gov/publications/detail/fips/202/final

On 2022-01-25 10:22 a.m., Behcet Sarikaya wrote:
>     One can download my Sage code, some conversion functions, and
>     examples via the link below. The conversion functions follow
>     Appendix I of the lwig curve draft.
>
>>>     On 22. Jan 2022, at 00:32, Rene Struik<[email-masked]>  <mailto:[email-masked]>  wrote:
>>>