Subject: Re: CALL FOR DISCUSSION - Do we want to specify EC in PKINIT?

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 18 Apr 2005 19:03:53 -0400

On Monday, March 14, 2005 08:42:31 PM -0500 Jeffrey Hutzelman 
<[email-masked]> wrote:

> This is ticket #840
>
> Through the last few revs of PKINIT, various text has been proposed
> related to supporting Diffie-Hellman exchanges using elliptic curve
> groups.  A number of changes we have already agreed on, particularly the
> use of AlgorithmIdentifier in TD-DH-PARAMETERS, insure that it will be
> possible for a separate document to specify support for EC groups in an
> interoperable way.
>
> Actually specifying EC group support requires some additional text,
> including what algorithm OID's to use, how to derive the shared secret,
> and possible some RECOMMENDED groups for interoperability.  There may be
> other needed bits as well; I'm not sure.
>
> The topic of this ticket is to determine whether there is support withing
> the working group for specifying EC groups support within the main PKINIT
> document, and if not, whether there is support for doing so in a separate
> standards-track document.  Much of the needed text is already in
> pkinit-25; however, if there is not a consensus to include this in
> PKINIT, that text will be removed.
>
> So, I'd like to see some discussion on this issue.  I know this is not a
> cut-and-dried question; there are a number of issues and viewpoints which
> I expect will come out in the course of the discussion...

Well, sometimes expectations can be wrong.
I've seen a few people indicate that they would rather see this in a 
separate document, and at least one person seems to strongly prefer to 
include it in this document.

Sam cited a concern about IPR issues as one reason for his opposition to 
specifying this in the main PKINIT document.  Larry says that, according to 
his source, there are no IPR issues.  So now we have a conflict.

I know people believe there are IPR issues with respect to ECDH, but at 
least on this mailing list, I have seen no actual references to specific 
issues that may cause problems for us.  I know it is impossible to prove a 
negative like "there are no IPR issues", but it would be helpful if people 
who object on these grounds could cite specific references, instead of 
vague fears.

-- Jeff