Re: [Cfrg] Safecurves draft

[Manuel Pégourié-Gonnard <[e-mail]>]

On 09/01/2014 00:50, Watson Ladd wrote:
> The EFD formulas will go in appendix to address the URL problem, and
> to address some people's desire for explicit formulas.

When copying the EFD formulas in the appendix, please don't forget to define the
meaning of the variables. For example, for Montgomery curves [1] use X1, X2, ...
X5 without mentioning explicitly (unless I missed something) that the formulas give

	(X4, Z4) = 2 (X2, Z2)
	(X5, Z5) = (X2, Z2) + (X3, Z3)

for inputs such that (X1, 1) = (X2, Z2) - (X3, Z3). Reminding readers about
Montgomery ladders (so that this last condition makes sense) cannot hurt. By the
way, it might be worth pointing out that the formulas in the EFD use (A+2)/4, as
opposed to the formulas in the Curve25519 paper, that use (A-2)/4. (I may be
dense, but I got bitten by this.)

[1]: http://www.hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#ladder-mladd-1987-m

This was for Montgomery curves since that's the kind I'm the most familiar with
right now, but similar remarks probably apply for twisted Edwards curves.

By the way, it might be good to insert a word of warning about the fact that the
design of the curves themselves doesn't automatically protect from all
side-channels, and some points are still the responsibility of implementers:
avoid branches and data-dependant memory accesses in the ladder, and either use
constant-time field arithmetic or randomize projective coordinates.

Manuel.