Re: [TLS] (selection criteria for crypto primitives) Re: sect571r1

2015-07-21 Thread Johannes Merkle
Rene Struik schrieb am 16.07.2015 um 03:42: > Dear colleagues: > > It seems prudent to keep some diversity of the gene pool and not only have > curves defined over prime curves. Similarly, > one should perhaps have some diversity of gene pool criteria within the set > of recommend curves and not

Re: [TLS] Why are the brainpool curves not allowed in TLS 1.3?

2018-07-17 Thread Johannes Merkle
Hi, > There's a very strong reason against this: It creates complexity. More > opportunities for attacks, more fragmentation of the ecosystem. I > believe I speak for a lot of people here when I say that fewer > algorithms is better and having more algs "just because" is not a good > reason. With

Re: [TLS] Why are the brainpool curves not allowed in TLS 1.3?

2018-07-17 Thread Johannes Merkle
> We've been through this before, e.g.: > > https://www.ietf.org/mail-archive/web/tls/current/msg10271.html > https://bada55.cr.yp.to/brainpool.html > > ...the latter of which quotes you as saying the repeated digits in the "A" > and "B" values used in Brainpool seed generation process were "un

Re: [TLS] Why are the brainpool curves not allowed in TLS 1.3?

2018-07-17 Thread Johannes Merkle
Eric Rescorla schrieb am 17.07.2018 um 17:47: > We've > generally decided to limit the number of algorithms we recommend (the > Recommended) column in the registry. I have trouble seeing any situation in > which we would have these curves as Recommended. And so "at hand" really > means (1) code poi

Re: [TLS] Why are the brainpool curves not allowed in TLS 1.3?

2018-07-19 Thread Johannes Merkle
>> Code points for pre-1.3 were assigned, and they are invalid for TLS 1.3. >> Those “you should not send these for 1.3” could be re-used for TLS 1.3, if >> that was desired. > > Yes this makes sense. And I think that they should, documented as something > other than “Recommended”. > I still