Subject: [TLS] Fwd: New Version Notification for draft-josefsson-tls-curve25519-05.txt

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Mon, 14 Apr 2014 10:34:11 +0200

Hi,

The "Curve25519 in TLS" draft has been updated. Highlight of the main changes:

1. Switch to little-endian for points (aka public keys). Besides the arguments
that has been discussed previously, I feel like it makes the exposition clearer
and shorter by allowing to use "Curve25519 from the paper" as a black box,
rather than looking at its internals.

2. Add a leading 0x41 byte to the point format, and a corresponding
ECPointFormat value to negotiate use of this format in TLS. (The goal here is to
allow other formats to be use with Curve25519 in the future.)

3. Update the "Security Consideration" section:
a. Mention ephemeral vs "cached" keys in relation with side-channels.
b. Don't attempt an exhaustive comparison of Curve25519 with all other curves
available in TLS, but limit the comparison to two specific curves : NIST P-256
and Brainpool P-256. Writing an exhaustive comparison is a lot of work, and
should probably be a CFRG rather than a TLS document.

4. Add a description of the Curve25519 function, with complete formulas and
implementation hints, in an appendix. I'm not sure if this appendix should be
part of this document, or become the basis for a separate document, since it is
not specific to TLS. Anyway, for now it seemed easier and faster to put a first
version here as an appendix.

I'm sure many parts of the text can still be improved, but I really think/hope
that the parts that affect interop (negotiation, wire format, definition of the
PMS) are now quite stable.

Unfortunately, I'll be offline for one week starting this afternoon, so I
apologize in advance for the delay in responding to your comments.

Manuel.

-------- Original Message --------
Subject: New Version Notification for draft-josefsson-tls-curve25519-05.txt
Date: Sun, 13 Apr 2014 14:33:29 -0700
From: [email-masked]
To: Simon Josefsson <[email-masked]>, "Manuel Pegourie-Gonnard"
<[email-masked]>, "Simon Josefsson" <[email-masked]>, Manuel
Pegourie-Gonnard <[email-masked]>

A new version of I-D, draft-josefsson-tls-curve25519-05.txt
has been successfully submitted by Manuel Pegourie-Gonnard and posted to the
IETF repository.

Name:		draft-josefsson-tls-curve25519
Revision:	05
Title:		Curve25519 for ephemeral key exchange in Transport Layer Security (TLS)
Document date:	2014-04-13
Group:		Individual Submission
Pages:		12
URL:
http://www.ietf.org/internet-drafts/draft-josefsson-tls-curve25519-05.txt
Status:         https://datatracker.ietf.org/doc/draft-josefsson-tls-curve25519/
Htmlized:       http://tools.ietf.org/html/draft-josefsson-tls-curve25519-05
Diff:           http://www.ietf.org/rfcdiff?url2=draft-josefsson-tls-curve25519-05

Abstract:
   This document specifies the use of Curve25519 for ephemeral key
   exchange in the Transport Layer Security (TLS) protocol, as well as
   its DTLS variant.  It updates RFC 5246 (TLS 1.2) and RFC 4492
   (Elliptic Curve Cryptography for TLS).

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat