Subject: [Cfrg] I-D Action: draft-irtf-cfrg-curves-03.txt

From: [email-masked]
Date: Sun, 16 Aug 2015 16:53:46 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Crypto Forum Working Group of the IETF.

        Title           : Elliptic Curves for Security
        Authors         : Adam Langley
                          Mike Hamburg
                          Sean Turner
	Filename        : draft-irtf-cfrg-curves-03.txt
	Pages           : 17
	Date            : 2015-08-16

Abstract:
   This memo specifies two elliptic curves over prime fields that offer
   high practical security in cryptographic applications, including
   Transport Layer Security (TLS).  These curves are intended to operate
   at the ~128-bit and ~224-bit security level, respectively, and are
   generated deterministically based on a list of required properties.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-curves/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-irtf-cfrg-curves-03

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-curves-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 17 Aug 2015 10:15:55 +0300

>       Filename        : draft-irtf-cfrg-curves-03.txt

Some quick comments:

1) Section 4.1:

Could use sqrt(-486664) instead of sqrt(-1)*sqrt(486664) in
isomorphism maps. Neither has any pleasant numerical value.

2) Section 4.2:

Value of d looks badly linewrapped, with \ in middle of line.
Same for X(P) and Y(P)

3) Section 4.2:

"(u, v) = (x^2/y^2, (2 - x^2 - y^2)*x/y^3)"

Isn't it (u,v)= (y^2/x^2, (2 - x^2 - y^2)*y/x^3) or something like
that?

(Didn't check the dual isogeny)

4) Section 4.2:

No basepoint is given for "Edwards448". Could give prime order
basepoint that maps to u=5, v=355...362

Such basepoint seems to be:
x=2245800402959243001876043340998960362467896416325641342461254616869\
  50415467406032909029192869357953282578032075146446173674602635247710
y=2988192100784814926760179304439306734375440401540802420959282413723\
  31506189835876003536878655418784733982303233503462500531545062832660

5) Section 6.1:

"Alice and Bob can then use a key-derivation function, such as hashing
K, to compute a key."

Maybe change example to hash K, K_A and K_B, given that just hashing
K tends to lead to problems (THS anyone?)

-Ilari

---

From: Adam Langley <[email-masked]>
Date: Mon, 17 Aug 2015 08:22:27 -0700

Thanks! In https://github.com/agl/cfrgcurve/commit/3c1d601c22493a4c1dbbfad8bc42f5d48fa8c518
:

> isomorphism maps. Neither has any pleasant numerical value.

Done.

> Value of d looks badly linewrapped, with \ in middle of line.

Thanks, done. (Also fixed a few other cases that rendered badly in text mode.)

> (Didn't check the dual isogeny)

I'm pretty sure that the isogeny maps are wrong and I've already asked
Mike to check them. He's out-of-action to an uncertain degree at the
moment but hopefully he can confirm that you're correct.

(There are a few other known TODOs in the commit comment at
https://github.com/agl/cfrgcurve/commit/dfac95c16f126ae47eb7b0cc59c916bf2d91c3f0)

> x=2245800402959243001876043340998960362467896416325641342461254616869\

I've added TODOs to note that we need to add this but since the
isogeny maps are wrong

> K tends to lead to problems (THS anyone?)

Done.

Cheers

AGL

---

From: Michael Hamburg <[email-masked]>
Date: Mon, 17 Aug 2015 11:44:28 -0700

> On Aug 17, 2015, at 8:22 AM, Adam Langley <[email-masked]> wrote:
> 

That’s correct.  Should also negate y in the dual isogeny, otherwise it maps (0,1) to (0,-1).

>> x=2245800402959243001876043340998960362467896416325641342461254616869\

Looks right to me with the new isogeny maps.

>> K tends to lead to problems (THS anyone?)

Cheers,
— Mike

---

From: Adam Langley <[email-masked]>
Date: Tue, 18 Aug 2015 10:11:04 -0700

Thanks both. I've updated the draft in light of this and kicked out
-04: https://www.ietf.org/id/draft-irtf-cfrg-curves-04.txt

Cheers

AGL