Subject: Re: [Cfrg] CFRG Spring 2014 Interim Meeting on ECC: request for input

From: Patrick Longa Pierola <[email-masked]>
Date: Fri, 18 Apr 2014 00:03:33 +0000

Dear CFRG co-chairs,
In response to your call for presentations on ECC, we would like to propose a talk based on our work on selecting elliptic curves for cryptography (eprint version posted at http://eprint.iacr.org/2014/130). You can find more details below, including a brief abstract.
We do not have problems with any date between April 28 and May 2. Given that we are in PT, we would recommend presenting sometime between 12pm-6pm EDT.

Title: Selecting Elliptic Curves for Cryptography
Speaker: Patrick Longa

In this talk we discuss the criteria and security analysis that we used to select a set of elliptic curves for cryptography that covers both the Weierstrass and twisted Edwards models. Taking advantage of (efficient) dedicated group law formulas and a new complete addition for Weierstrass curves, we show how to compute constant-time, exception-less scalar multiplications that offer high security and performance in practice. Finally, we present experimental results that shed new light on the relative performance between Weierstrass, twisted Edwards and Montgomery curves. All this is illustrated in the setting of the relevant TLS handshake using perfect forward secrecy (PFS).

This is joint work with Joppe Bos, Craig Costello and Michael Naehrig.

This presentation is based on the preprint (under submission): http://eprint.iacr.org/2014/130

Time requested: 30 minutes

Patrick Longa
Microsoft Research

________________________________
From: David McGrew<mailto:mcgrew%20at%20cisco.com>
Sent: ‎10/‎04/‎2014 14:13
To: cfrg at irtf.org<mailto:cfrg%20at%20irtf.org>; Igoe, Kevin M.<mailto:kmigoe%20at%20nsa.gov>; Stephen Farrell<mailto:Stephen.Farrell%20at%20cs.tcd.ie>; kathleen.moriarty at emc.com<mailto:kathleen.moriarty%20at%20emc.com>; Sean Turner<mailto:turners%20at%20ieca.com>; Joseph Salowey<mailto:jsalowey%20at%20cisco.com>; Eric Rescorla<mailto:ekr%20at%20rtfm.com>
Subject: [Cfrg] CFRG Spring 2014 Interim Meeting on ECC: request for input
CFRG Spring 2014 Interim Meeting on ECC: request for input
There is broad interest in the use of new elliptic curve cryptography
mechanisms, and the Transport Layer Security (TLS) Working Group in
particular has asked CFRG for input on what mechanisms are suitable for
use in that protocol.   At the IETF89 meeting of the CFRG, it was
decided to hold an interim meeting via teleconference, in order to allow
more time for presentations and discussions on elliptic cryptography,
and to also be more inclusive of CFRG members that do not typically
attend IETF meetings. Presentations are invited on elliptic curve
cryptography mechanisms (including both curves and algorithms), their
security, their performance, and criteria for their selection and use in
IETF standards.   Preference will be given to presentations that cover
published documents, if time is limited.

If you are interested in attending, please complete the doodle poll at
http://doodle.com/cqg7eu9m3xugwrps and vote on the time and day for the
meeting.   We are targeting  April 28 through May 2. Duration is to be
determined by number of presenters, but the target will be two to three
hours.

If you are interested in presenting, respond to this email with a
description of your presentation that includes a title, a short summary
of the contents, and a duration.

The meeting will use Webex (http://www.webex.com/), and participants
should verify that they can use that software as needed to view or
present slides.

David and Kevin

_______________________________________________
Cfrg mailing list
Cfrg at irtf.org
http://www.irtf.org/mailman/listinfo/cfrg

---

From: David McGrew <[email-masked]>
Date: Fri, 18 Apr 2014 07:20:44 -0400

Hi Patrick,

On 04/17/2014 08:03 PM, Patrick Longa Pierola wrote:
>
> Dear CFRG co-chairs,
>
> In response to your call for presentations on ECC, we would like to 
> propose a talk based on our work on selecting elliptic curves for 
> cryptography (eprint version posted at 
> http://eprint.iacr.org/2014/130). You can find more details below, 
> including a brief abstract.
>
> We do not have problems with any date between April 28 and May 2. 
> Given that we are in PT, we would recommend presenting sometime 
> between 12pm-6pm EDT.
>

got it.   Thanks for sending out the reference.

David

> In this talk we discuss the criteria and security analysis that we 
> used to select a set of elliptic curves for cryptography that covers 
> both the Weierstrass and twisted Edwards models. Taking advantage of 
> (efficient) dedicated group law formulas and a new complete addition 
> for Weierstrass curves, we show how to compute constant-time, 
> exception-less scalar multiplications that offer high security and 
> performance in practice. Finally, we present experimental results that 
> shed new light on the relative performance between Weierstrass, 
> twisted Edwards and Montgomery curves. All this is illustrated in the 
> setting of the relevant TLS handshake using perfect forward secrecy (PFS).
>
> ------------------------------------------------------------------------
>
> *From**: *David McGrew <mailto:mcgrew%20at%20cisco.com>
> *Sent**: *?10/?04/?2014 14:13
> *To**: *cfrg at irtf.org <mailto:cfrg%20at%20irtf.org>; Igoe, Kevin M. 
> <mailto:kmigoe%20at%20nsa.gov>; Stephen Farrell 
> <mailto:Stephen.Farrell%20at%20cs.tcd.ie>; kathleen.moriarty at 
> emc.com <mailto:kathleen.moriarty%20at%20emc.com>; SeanTurner 
> <mailto:turners%20at%20ieca.com>; Joseph Salowey 
> <mailto:jsalowey%20at%20cisco.com>; EricRescorla 
> <mailto:ekr%20at%20rtfm.com>
> *Subject**: *[Cfrg] CFRG Spring 2014Interim Meeting on ECC: request 
> for input
>
> [email-masked]

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Fri, 18 Apr 2014 18:08:38 -0400

> got it.   Thanks for sending out the reference.

Should we pick a date?  If so, what is the process for doing so?  how
would the presentation be performed?  Will there be an opportunity for
Q&A following the presentation?

The proposed dates are quite soon.

	--dkg

---

From: David McGrew <[email-masked]>
Date: Fri, 18 Apr 2014 18:42:13 -0400

On 04/18/2014 06:08 PM, Daniel Kahn Gillmor wrote:
> Should we pick a date?  If so, what is the process for doing so?

The process is simple: I will choose a slot that is available to all of 
the people who have asked to present.  It is Tuesday, April 29 from 
3-6PM ET.

>   how
> would the presentation be performed?

A Webex teleconference.   Please see 
http://www.webex.com/test-meeting.html   Webex provides a bridge for 
audio, shared desktop viewing, and chat.   If you want to participate 
only in the audio portion of the conference, you can do that by calling 
a toll free number, and you do not need to enable Java in your 
browser.   If you want to participate in the shared desktop and chat, 
then you will need to use the software.   We will ask that slides be 
distributed in advance so that people can follow along on the audio bridge.

> Will there be an opportunity for

Absolutely.   If you have other suggestions for what should be on the 
agenda, feel free to make suggestions.

> The proposed dates are quite soon.

True, but I think we can have some good presentations and discussions, 
and we ought to meet before the TLS interim meeting that is taking place 
mid-May, so that we can provide input to that working group.

David