Subject: Re: [TLS] Importance of ECDSA for TLS (was: PSS for TLS 1.3)

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 27 Mar 2015 16:10:44 +0000

Dear Ilari,

On 24/03/2015 12:11, "Ilari Liusvaara" <[email-masked]> wrote:

>On Mon, Mar 23, 2015 at 07:42:26PM +0000, Paterson, Kenny wrote:
>>
>> 
>> Just a quick heads-up with my CFRG hat on. We should soon be making a
>> start over there on defining signature schemes for use with the curves
>> that we have now selected; our DH deliberations are nearing completion.
>> 
>> One quick question for this group: how important is it to you to have
>> ECDSA - or something very close to it (e.g. a derandomised version) -
>>for
>> TLS use, and how much appetite is there for adopting schemes that
>>deviate
>> more significantly from ECDSA (e.g. EdDSA)?
>
>My personal view (I have also looked at what this would take):
>Not important, I would very much like a modern signature system (esp.
>inversion-free[1]).

Thanks for this feedback. This was also the view at the CFRG meeting this
week in Dallas, but we will take it to the CFRG list for further
discussion in the near future.

>But I would want:
>- Both curves usable in the same signature framework.
>- Only use common hash function propeties for both curves[2], especially
>  for verification interop[3].
>
>
>Assignments required:
>- TLS signaturealgorithm codepoint
>- TLS namedcurve codepoints
>- OIDs for the signature curves
>- OIDs for PKIX (Signature,Hash) algorithm pair.
>
>All can be done with RFC & expert review.
>
>
>[1] Inversions are not only highly annoying to implement safe way,
>but are also pretty slow.
>
>[2] Good test: Does this work with standard-issue SHA-512?
>
>[3] This is for the case if anything happens to the primary algorithm.

All noted.

Best wishes,

Kenny 

>-Ilari