[Cfrg] Edwards ladder

[Watson Ladd <[e-mail]>]

Dear all,

The formulas on the EFD for a y-coordinate only Edwards ladder require
d to be a square. They are slightly more efficient than the Montgomery
ladder when squaring is specially optimized. Unfortunately, the
Edwards curve formulas we are considering don't have d square.

The relatively little amount of thought I've given to this matter
hasn't produced an isogeny that makes d square. Furthermore, picking d
square makes the addition laws not complete: it's not possible to have
both the efficient ladder and a complete addition law simultaneously
when using Edwards coordinates.

As a result, I think we don't have an alternative to Montgomery
x-coordinate only that is as efficient and as secure, and certainly
not as simple.  I think that most people on the list are in agreement
about this.

This leaves signatures and which form of Montgomery ladder ECDH to use
as open issues.

Sincerely,
Watson Ladd