Re: [Cfrg] Curve manipulation, revisited

[Watson Ladd <[e-mail]>]

On Mon, Dec 29, 2014 at 3:36 PM, Benjamin Black <[e-mail]> wrote:
> On Mon, Dec 29, 2014 at 12:25 PM, Watson Ladd <[e-mail]> wrote:
>>
>>
>> I also don't see why this matters: now that Montgomery x form and
>> complete coordinates for signatures are being used, there isn't a
>> difference between the rival proposals on this point.
>>
>
> Does this mean you find the draft with the additions of x-only and the
> cofactor constraint acceptable?

No, for several reasons.

2^389-21 has significant performance benefits on Haswell, 8-9% over
2^384-big, which performs the same way as Ed448. Our early
measurements were on other platforms, with relatively unoptimized
code, and didn't compare to the NUMS code you released, but to your
performance numbers. Because we used different benchmarking setups,
there was a systemic error in our cycle counts vs. yours. Now that we
remeasured your code with our benchmark, we get better numbers. (We is
misleading: Mike Hamburg did a lot more of the work then I did, and
the suggestion was Ilari Liusivaas. My sole contribution was writing a
terrible first cut, which Mike threw out for the second version)

The easiest way to get good numbers across multiple platforms would be
a SUPERCOP run. I've screwed up enough measurements to know that one
needs the same framework for as many numbers as possible, otherwise
you benchmark the testbench. But the NUMS people have made sure that
won't happen.

If you want ECDSA, use Weierstrass form. It's not ECDSA if you don't.
I get the idea of the FrankenECDSA, but I'd like to know that it would
be actually useful and speed adoption in TLS, and it relies on
implementations that have a generic ECDSA that calls curve specific
multiply functions. Maybe FrankenECDSA is useful: my guess is it
isn't, but I could be convinced. But this doesn't affect what curve to
use.

As for customers, if they don't find Curve25519 acceptable, they won't
find a curve that's Curve25519 with a different basepoint acceptable
unless they really have no idea how things work. At this point you've
already agreed to Curve25519, modulo the basepoint, which doesn't
matter for security, but does matter for implementators. Why have this
waste?

Sincerely,
Watson Ladd

>
>
> b
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin