Re: [Cfrg] Safecurves draft

[Robert Ransom <[e-mail]>]

On 1/9/14, Bodo Moeller <[e-mail]> wrote:
> In that context, given that the name
> "Curve25519" is already overloaded, and that we probably should make the
> Edwards representation available for DH too (in addition to EdDSA),

No.  Montgomery-form variable-base single-scalar multiplication takes
5M+4S per scalar bit; Edwards-form doublings alone (in ‘extended
coordinates with a=-1’) are 4M+4S (or 3M+4S if the output will only be
used as input to another doubling).  There is no reason to use an
Edwards-form y coordinate in a Curve25519 point representation that
will be used for DH.  (But there's also no reason to use a
Montgomery-form y coordinate in a Curve25519 point representation;
even if the point will need to be compatible with use in ECDH, use the
Edwards-form x coordinate or its sign bit instead.)

(For some other curves over large (at least 8-limb) coordinate fields,
e.g. s=2170 over the Curve3617 coordinate field, the 3M+6S formulas
shown at <http://hyperelliptic.org/EFD/g1p/auto-edwards-yzsquared.html>
are faster, but Dr. Bernstein wouldn't consider those curves to be
‘safe’.  (The differential addition formulas on that page have an
exceptional case at Y1=0.))


Robert Ransom