Re: [Cfrg] Chopping out curves

On Fri, Jan 17, 2014 at 10:58 AM, Alyssa Rowan <akr@akr.io> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 17/01/2014 14:33, Robert Ransom wrote:
>> Watson Ladd actually chose a point with small Edwards-form x, not
>> small Edwards-form y. […] ‘T25519’ is isomorphic to Curve25519, so
>> any non-identity group element of odd order on T25519 generates the
>> same group as the standard basepoint of Curve25519 (and has the
>> same order).
>
> Ah, thankyou. I missed that (and had mistakenly assumed he'd go for
> small y to match the Edwards curves).
>
> Clearly, I haven't had enough tea today!
>
>
> On 17/01/2014 14:33, Robert Ransom wrote:
>> There is no benefit to choosing a new basepoint, but there's also
>> no benefit to using ‘T25519’ instead of the (more efficient) form
>> specified for Ed25519.
>
> On 17/01/2014 15:17, Watson Ladd wrote:
>> On reflection the a=-1, d=-121665/121666 form saves an an
>> addition, but the multiplication is by a bigger number in the
>> complete form. Anyway, I don't have strong thoughts on the matter.
>
> Well then, there's little or no benefit in specifying a new form when
> we already have the Ed25519 parameters ready-made and people already
> have routines working with it?
>
>
> On 17/01/2014 14:33, Robert Ransom wrote:
>>> I have a strong preference for throwing out T25519 and using
>>> Ed25519 with its standard basepoint.
>
> On 17/01/2014 15:17, Watson Ladd wrote:
>> I'll follow that preference, but ugh, the number in front of
>> x^2y^2 is big.
>
> If it doesn't really have a performance impact in practice, it's no
> big deal.
>
> Ed25519 it seems to be, then. Though, that said, the name might be
> confusing. Maybe we'd better call that form something else.
>
> Perhaps: 'te25519', for Twisted Edwards (2^255)-19?

Okay. I'll follow the Ed25519 paper and call it te25519 and add the
paper as a reference.
Are rationals fine, or do people want me to write big numbers?
>
> (Deliberately referring to the curve names in lower-case. Thinking
> ahead to when people put these things on command-lines or config files
> and argue about capitalisation; none of the other curves in IETF
> protocols get capitals.)
>
> • If we called it 't25519', people might confuse it with the one in the
>   draft here.

it's an ID: names change.

>
> • But if we call it 'Ed25519', people might confuse it with the whole
>   Ed25519 signature scheme.
>
>   (Sure it's used _in_ that signature scheme, although it seems likely
>   to me at this stage that we might be heading more in the general
>   direction of a cleaner, fresher version which works with te25519,
>   curve3617 and e521, and quite possibly uses a new hash. Demand seems
>   stronger for curve25519 ECDHE first, however.)
>
> - --
> /akr
> -----BEGIN PGP SIGNATURE-----
>
> iQIcBAEBCgAGBQJS2X1EAAoJEOyEjtkWi2t6tR0QALl42L1yV84EFgckps6R2rOe
> 30UOcOWx1XZGnU/Kdwt0w7YP8SvUbAtX97RgVlcgWQbG9CyYldELJ/39lZw7uyFF
> iNyNmIGYvXdrlxpWTNMry0lB8SLjZts+RJX0/ZcDD0qguGnmsP+IHUH7Q80hsjJ0
> CB9rvVVfuuAmDU5pWWOWHt8hEVhX9jl7vRuF4Yb51ngqHrS/NpasK2qaZ88Gw4Fp
> ns/b8OzZNoChxkAHYBlGVrkuCq6O9d8gpRaoxkl0ujsndvsZlQ2ud0FhVg/FXcRs
> le6YCig5rEuEoS/XwGUc4Mb6Py2BRJZ4C0Ax6ZTP1pOzH8OhwKskuEeLe7SVvKGu
> WhC5hgGz/Sub1nKBI/mTZNwZrY5kjEzg21iZ1kIbpK37V59TwplLOJzu/aalXDbU
> Sq0U1aW73Y6p+KSQKsGpSfeUpmY/6e19emoUQRbZ9J1eER/o2vjPAJcCmv+zfugx
> uE2moiZoc1mfCV5E7wIxZvUrU5bPk4ARSzHxhw7o/higqc/PZbtosFKEqeRBOz1I
> paqlewTRs7tQTwoSx9mn3+dln47Kz2y18pBAUM7BitUyWghMoJRq6Mm6crKkGG2O
> f2ZAkmKDlpEuLix9/ENlmGDl2i9ZXH7tALnOeYZ/txlFtagpUBSdLWSBGo0erEwp
> Q0AWcvz2wr81lOwpPuBq
> =w0/6
> -----END PGP SIGNATURE-----
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin