Subject: Re: Fwd: New Version Notification for draft-green-secsh-ecc-07

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 01 Jun 2009 16:24:34 -0700

>> A new version of I-D, draft-green-secsh-ecc-07.txt has been
>> successfuly submitted by Douglas Stebila and posted to the IETF
>> repository.
>>
>> Filename:	 draft-green-secsh-ecc
>> Revision:	 07
>> Title:		 Elliptic-Curve Algorithm Integration in the Secure Shell
>> Transport Layer
>> Creation_date:	 2009-04-27
>> WG ID:		 Independent Submission
>> Number_of_pages: 23
>>
>> Abstract:
>> This document describes algorithms based on Elliptic Curve
>> Cryptography (ECC) for use within the Secure Shell (SSH) transport
>> protocol.  In particular, it specifies: Elliptic Curve Diffie-Hellman
>> (ECDH) key agreement, Elliptic Curve Menezes-Qu-Vanstone (ECMQV) key
>> agreement and Elliptic Curve Digital Signature Algorithm (ECDSA) for
>> use in the SSH Transport Layer protocol.

Has anyone here tried to implement this?  I'm in the process of preparing a 
writeup to go along with the publication request for this document, and I'd 
like to hear from anyone willing to share their implementation experience.

-- Jeff

---

From: der Mouse <[email-masked]>
Date: Mon, 1 Jun 2009 23:20:24 -0400 (EDT)

> Has anyone here tried to implement this?

I'd like to, but it appears unimplementable without copies of X9.63 and
IEEE1363, with no indication where to find either.  (Past experience
with ANSI and IEEE leads me to expect that each is pay-to-play, which,
if true, makes this draft a total non-starter in my opinion.)

If that guess is wrong, and you can point me at enough documentation to
actually build an implementation, I would love to have at it.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Douglas Stebila <[email-masked]>
Date: Tue, 2 Jun 2009 13:38:36 +1000

> actually build an implementation, I would love to have at it.

ANSI X9.63 and IEEE 1363 are listed as informative references only.  I  
believe that SEC 1, listed as a normative reference, contains all  
information required to implement ECDH, ECDSA, and ECMQV; it is freely  
available from the URL in the references.  Is there something specific  
that you believe requires ANSI X9.63 or IEEE 1363, or some wording  
that I should clarify?

Douglas

---

From: der Mouse <[email-masked]>
Date: Tue, 2 Jun 2009 00:04:03 -0400 (EDT)

>> Has anyone here tried to implement [draft-green-secsh-ecc]?
>> I'd like to, but it appears unimplementable without copies of X9.63
>> and IEEE1363, [...]
> ANSI X9.63 and IEEE 1363 are listed as informative references only.
> I believe that SEC 1, listed as a normative reference, contains all
> information required to implement ECDH, ECDSA, and ECMQV; it is
> freely available from the URL in the references.

Actually, it is not; it is at least two and I think three links removed
from the URL in the references.  (The shortest path I've found is
http://www.secg.org/ -> "Documents" ->
http://www.secg.org/index.php?action=secg,docs_home -> "Released
Standards" -> http://www.secg.org/?action=secg,docs_secg -> "SEC1:
Elliptic Curve Cryptography version 2.0" ->
http://www.secg.org/download/aid-780/sec1-v2.pdf.)

> Is there something specific that you believe requires ANSI X9.63 or
> IEEE 1363, or some wording that I should clarify?

That was the impression I was left with by the text

   Implementation of this specification requires familiarity with both
   SSH [RFC4251] [RFC4253] [RFC4250] and ECC [SEC1] [IEEE1363]
   [ANSI-X9.63].

   This document is concerned with SSH implementation details;
   specification of the underlying cryptographic algorithms is left to
   other standards documents.

Rereading in light of what you said, I can see that it doesn't quite
say that X9.63 and 1363 are necessary; the wording of that section
might be improvable - perhaps a note in the second of those paragraphs
that [SEC1] is believed sufficient for implementation?

I'll try to get around to slogging through converting [SEC1] (which
appears to be provided only as another of those damned PDFs) into
something usable, and see what I can do with it.  (I've found software
that can mostly convert PDFs to text, but it's...well, it's got few
edges that _aren't_ rough, at the moment.)

/~\ The ASCII				  Mouse
\ / Ribbon Campaign

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 02 Jun 2009 18:20:17 +1200

>   SSH [RFC4251] [RFC4253] [RFC4250] and ECC [SEC1] [IEEE1363]

Isn't it X9.62 rather than 9.63 that'd be useful here?  It includes a lot more
detail on the ECC mechanisms, and has the convenient side-effect that you can
test your code on static data (ECDSA certs) before you try it against a
server.

Peter.

---

From: Douglas Stebila <[email-masked]>
Date: Tue, 2 Jun 2009 21:47:52 +1000

I will clarify the language and URLs concerning the relevant documents  
before it goes to RFC.  Thanks all.

Douglas

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 02 Jun 2009 09:36:16 -0700

> http://www.secg.org/download/aid-780/sec1-v2.pdf.)

This is true.  A better reference would be one that includes a link 
directly to the document in question, rather than just to the SECG web 
site.  However, a stable reference is important too -- a URL that will stop 
working is not very useful.

-- Jeff