Subject: Re: [CFRG] [Cfrg] Fwd: Last Call: <draft-ietf-lwig-curve-representations-12.txt> (Alternative Elliptic Curve Representations) to Informational RFC

From: John Mattsson <[email-masked]>
Date: Tue, 10 Nov 2020 12:47:05 +0000

Benjamin Kaduk wrote:

> I think we've seen this draft discussed previously, but just wanted to raise visibility that it has entered IETF Last Call.

I don't think this draft has been discussed in any working group outside of LWIG. At least I cannot find anything in the mail achieves. I re-read the draft this week as Göran Selander (COSE IANA expert) raised the draft on the COSE WG list. Re-reading it I was surprised to see that the draft now standardizes new curves and register their use in COSE, JOSE, CMS, PKIX. I did not expect such a draft from LWIG. When I reviewed the draft some time ago it only contained formulas to enable use of existing implementations. The abstract does not mention this and has basically not been updated since the -00 version. When I reviewed the draft in LWIG some time ago it only contained formulas to enable use of existing implementations.

- The draft tries to register a lot of low values (-1, -2, -9, -24, -48, -49) in the COSE registries which it obviously cannot as the draft is informational, and the registrations require standards action.

- If a new ECDSA25519 registration is needed for COSE and JOSE, it should be needed for PKIX and CMS as well. My understanding is that ES256 and ecdsa-with-SHA256 are basically the same.

- This draft defines a curve named Wei25519. NIST.SP.800-186-draft defines a curve named W-25519. I really do not want to repeat the mess with secp256r/prime256v1/P-256 where different SDOs standardized different names for the same curve.

- IETF curve definition and OID and IANA registrations of curve25519 in Weirstrass form should absolutely be coordinated with NIST. The last thing anybody want is two identifiers for the same curve, or even worse, two slightly different versions of curve25519 in Weirstrass form. Quickly looking at draft-ietf-lwig-curve-representations-13 and NIST.SP.800-186-draft it looks like the y-coordinate of G is different for Wei25519 and W-25519...

(Otherwise I am positive to the content of this draft and the registration of curve25519 in Weirstrass form for COSE, JOSE, CMS, PKIX).

Cheers,
John