Re: [Cfrg] Point format endian (was: Adoption of draft-ladd-spake2 as a RG document)

Peter Gutmann <> Tue, 27 January 2015 11:45 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id E751A1A876C for <>; Tue, 27 Jan 2015 03:45:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.21
X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id xWcy17PebD_Q for <>; Tue, 27 Jan 2015 03:44:59 -0800 (PST)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id B28191A877B for <>; Tue, 27 Jan 2015 03:44:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; q=dns/txt; s=uoa; t=1422359099; x=1453895099; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=P8sz828DmydjIQwvhcD0ims0lFms5iH6ridj57tIEi8=; b=q9YTIQCLvwhAZrdd4Pj+C9DY2EHCeMlmbtuw8OJKseo7D+QvLk5lIXNx M4jh9zkcSgL/CICV4KqWXax/txv57lZEQ17tOj11caQSKYelcSa1QLJdq 8PARl1BV2ViFIEGzfAIHSvGraaUeWjW8ZEsz/1xRHpdsx7bjFLMOPD4C1 o=;
X-IronPort-AV: E=Sophos;i="5.04,630,1406548800"; d="scan'208";a="303901618"
X-Ironport-Source: - Outgoing - Outgoing
Received: from ([]) by with ESMTP/TLS/AES256-SHA; 28 Jan 2015 00:44:54 +1300
Received: from ([]) by ([]) with mapi id 14.03.0174.001; Wed, 28 Jan 2015 00:44:47 +1300
From: Peter Gutmann <>
To: "''" <>
Thread-Topic: [Cfrg] Point format endian (was: Adoption of draft-ladd-spake2 as a RG document)
Thread-Index: AdA6JqZyE82jbGIkR3GvMKslgwBkuA==
Date: Tue, 27 Jan 2015 11:44:46 +0000
Message-ID: <>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [Cfrg] Point format endian (was: Adoption of draft-ladd-spake2 as a RG document)
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 27 Jan 2015 11:45:01 -0000

Stephen Farrell <> writes:

>You didn't say why. Why is it a bad idea? What is the downside?

The fact that it's one more piece of special-case code to add, debug, and test
when we've already got perfectly-functional, debugged, and tested code, some
of it in active use for twenty years or more, to do it present everywhere that
uses bignums.

(Another issue is that using a nonstandard form for representing the values is
bound to cause interop problems in the future when the 25519 form is the
opposite to what everything else does.  Look at the mess that occurred during
the AES competition with different endiannesses used in various algorithms,
until the problems were pointed out at the second AES conference by someone
who'd actually implemented things from the spec ("Implementation Experience
with AES Candidate Algorithms") and NIST revised the requirements).

If the "spec" for 25519 is going to be "the standard is to blindly do whatever
djb's code does" then there's no need for a spec or any CFRG involvement, just
provide a link to djb's code, since that'll be the spec.  It's decent code,
I'm not complaining about it, but the CFRG shouldn't be pretending to be
setting any standard if it's just "do whatever this code happens to do".  The
code then becomes the spec.