Re: [Cfrg] Chopping out curves

[Watson Ladd <[e-mail]>]

On Thu, Jan 16, 2014 at 6:36 PM, Adam Back <[e-mail]> wrote:
> Uh I meant the Curve25519 and Curve3617.  Sorry about that (again conflating
> safe curves and the Bernstein/Lange curves by the same authors.)

It would, but Curve25519 is a Montgomery curve and so we want an
Edwards curve for easy signatures.
T25519 should be the same curve, in a different form (if I didn't
screw up my basepoint choice, which I probably did. This weekend I
will do
a good computer search). Curve3617 has a nice Montgomery curve we
should describe for safe ECDH.

I feel like I'm coming around to Robert Ransoms arguments about how to
pick curves.
>
> Adam
>
>
> On Fri, Jan 17, 2014 at 02:14:14AM +0100, Adam Back wrote:
>>
>> Woulnt it make more sense to use two safe curve curves as they seem to be
>> what people are using and better tested/reviewed (re goldilocks).
>>
>> Adam
>>
>> On Thu, Jan 16, 2014 at 02:36:24PM -0800, Watson Ladd wrote:
>>>
>>> On Thu, Jan 16, 2014 at 2:07 PM, Dan Harkins <[e-mail]> wrote:
>>>>
>>>> On Thu, January 16, 2014 1:50 pm, Trevor Perrin wrote:
>>>>>
>>>>> On Thu, Jan 16, 2014 at 1:40 PM, Watson Ladd <[e-mail]>
>>>>> wrote:
>>>>>>
>>>>>> Dear all,
>>>>>> Trevor Perrin suggests that we only put in Curve25519/T25519 and
>>>>>> E383/M382 so implementors can focus on 4 curves ala Suite B. Are there
>>>>>> any protocols in which larger curves would be useful? Anything we
>>>>>> might be missing with this decision?
>>>>>
>>>>>
>>>>> I didn't quite suggest that.
>>>>>
>>>>> I do feel there should be fewer curves.  Perhaps only curve25519 and
>>>>> (either Curve3617 or Ed448-Goldilocks).
>>>>>
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin