Subject: Re: Comments on ECC draft

From: [email-masked] (Peter Gutmann)
Date: Tue, 24 Sep 2002 19:02:44 +1200 (NZST)

Len Sassaman <[email-masked]> writes:

>OpenSSL now has ECC in it

That's not certain yet, the licensing terms are such that it can't be used
under the OpenSSL license unless Sun re-release it unencumbered.

>and there is an ECC in TLS draft being proposed 

... by the same group who did the OpenSSL implementation.  Hardly an
overwhelming argument.

Peter.

---

From: Bodo Moeller <[email-masked]>
Date: Tue, 24 Sep 2002 09:37:12 +0200

> under the OpenSSL license unless Sun re-release it unencumbered.

Sun has nothing to do with the OpenSSL ECC implementation for GF(p).
ECC over GF(2^m) is due to Sun and is specifically "licensed pursuant
to the OpenSSL open source license".  There's an additional covenant
regarding patents, but nothing patent-encumbered should be enabled in
the default configuration (if you want GF(2^m) ECC to be faster, you
can set a compiler switch; in this case you have to accept the Sun
covenant).

-- 
Bodo Möller <[email-masked]>
PGP http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller/0x36d2c658.html
* TU Darmstadt, Theoretische Informatik, Alexanderstr. 10, D-64283 Darmstadt
* Tel. +49-6151-16-6628, Fax +49-6151-16-6036

---

From: Rodney Thayer <[email-masked]>
Date: Tue, 24 Sep 2002 07:58:55 -0700

>... by the same group who did the OpenSSL implementation.  Hardly an

Why do we want ECC in OpenPGP?

Why do we want to start using a class of algorithm that is patent encumbered?

Having corporations show up at working group meetings and threaten implementors
with patent infringement is a pain.

I don't see a requirement to add this.

A separate document describing it would of course be perfectly reasonable.

---

From: Hironobu SUZUKI <[email-masked]>
Date: Wed, 25 Sep 2002 10:57:54 +0900

> Why do we want ECC in OpenPGP?

I'm not againts ECC in OpenPGP in the future.

If someone want to use strong public key cryptography protection as
well as RSA-2048, ECC-193 is good choice.  But I don't need it today.

I think if RSA-1024 is broken easily, a quantum computer must be. In
future, developed quantum computation technique will also break ECC
because problems are in almost same domain of number theorem.

Anyway, I'd like think about it tomorrow, not today.

Regards,

-- 
Hironobu SUZUKI
E-Mail: [email-masked]
URL: http://h2np.net