Re: [Cfrg] Safecurves draft

Manuel Pégourié-Gonnard <> Thu, 09 January 2014 08:08 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 3E4571ADFD0 for <>; Thu, 9 Jan 2014 00:08:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.994
X-Spam-Status: No, score=0.994 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FH_RELAY_NODNS=1.451, HELO_EQ_FR=0.35, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.793] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id a4IulyDPcQtm for <>; Thu, 9 Jan 2014 00:08:37 -0800 (PST)
Received: from (unknown [IPv6:2001:4b98:dc0:41:216:3eff:feeb:c406]) by (Postfix) with ESMTP id 575361ACC89 for <>; Thu, 9 Jan 2014 00:08:37 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTPS id 4AC47161DF for <>; Thu, 9 Jan 2014 09:08:27 +0100 (CET)
Received: from [] (unknown []) by (Postfix) with ESMTPSA id 45FB02988A for <>; Thu, 9 Jan 2014 09:08:26 +0100 (CET)
Message-ID: <>
Date: Thu, 09 Jan 2014 09:08:25 +0100
From: Manuel Pégourié-Gonnard <>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Icedove/24.1.1
MIME-Version: 1.0
References: <> <> <> <> <>
In-Reply-To: <>
X-Enigmail-Version: 1.6
OpenPGP: id=98EED379; url=
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Subject: Re: [Cfrg] Safecurves draft
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 09 Jan 2014 08:08:39 -0000

On 09/01/2014 00:50, Watson Ladd wrote:
> The EFD formulas will go in appendix to address the URL problem, and
> to address some people's desire for explicit formulas.

When copying the EFD formulas in the appendix, please don't forget to define the
meaning of the variables. For example, for Montgomery curves [1] use X1, X2, ...
X5 without mentioning explicitly (unless I missed something) that the formulas give

	(X4, Z4) = 2 (X2, Z2)
	(X5, Z5) = (X2, Z2) + (X3, Z3)

for inputs such that (X1, 1) = (X2, Z2) - (X3, Z3). Reminding readers about
Montgomery ladders (so that this last condition makes sense) cannot hurt. By the
way, it might be worth pointing out that the formulas in the EFD use (A+2)/4, as
opposed to the formulas in the Curve25519 paper, that use (A-2)/4. (I may be
dense, but I got bitten by this.)


This was for Montgomery curves since that's the kind I'm the most familiar with
right now, but similar remarks probably apply for twisted Edwards curves.

By the way, it might be good to insert a word of warning about the fact that the
design of the curves themselves doesn't automatically protect from all
side-channels, and some points are still the responsibility of implementers:
avoid branches and data-dependant memory accesses in the ladder, and either use
constant-time field arithmetic or randomize projective coordinates.