Re: [Cfrg] Complete additon for cofactor 1 short Weierstrass curve?

[Watson Ladd <[e-mail]>]

On Thu, Dec 4, 2014 at 2:34 PM, Manuel Pégourié-Gonnard <[e-mail]> wrote:
> Hi,
>
> On 04/12/2014 23:17, Dan Brown wrote:
>> If this is all correct, then I would suggest that cofactor 1 short
>> Weierstrass do not have a security problem compared to Edwards curves (e.g.
>> cofactor 4), in the sense of lacking a complete addition law, but rather,
>> just an efficiency problem, in the sense of not having any (known) efficient
>> complete law.
>>
> I'm way too tired to check if the above is correct, but it seems to me that
> complete laws for general curves are known, see eg 29.1.2.a of the Handbook of
> Elliptic and Hyperelliptic Curve Cryptography (Cohen, Frey et al.).

That formula is accompanied by a discussion pointing out there is an
exceptional case, and so one has to switch between two different
formulas by reversing the order of coordinates under some conditions.
It's also unclear that infinity as an output or as an input is handled
correctly. (In fact, I think they aren't: if we add P to -P, the
denominator does not vanish, unless I'm missing something) Those
formulas would be "strongly unified" in the language of the EFD if I
understand correctly, but not "complete".

Sincerely,
Watson Ladd