Subject: Re: [pkix] Updated elliptic curve drafts

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 27 Nov 2015 17:19:27 -0500

On Fri, Oct 16, 2015 at 4:05 AM, Simon Josefsson <[email-masked]>
wrote:

> > I strongly oppose any new crypto that does not include a fix for the
> > ephemeral keygen.
>
> How is that concern relevant for a new PKIX signature/publickey
> algorithm?  I would assume this is relevant for TLS, OpenPGP, CMS, or
> other higher level protocols, but I don't follow how anything could be
> done at the PKIX level to help here.  Can you elaborate please?

It is quite straightforward. Any time you introduce a backwards
incompatible change, you should look to fix any outstanding errors in the
protocol.

The design of the existing ephemeral key scheme is broken. Introducing an
ephemeral secret should not reduce security, the security of the key should
never fall below the security of the static secret even if the ephemeral is
broken.

Given the number of modes that TLS/1.3 has and given the probability that
it is going to change, what I am looking for is confirmation that the
principle is accepted and understood.