Re: [Cfrg] Fwd: I-D Action: draft-turner-thecurve25519function-00.txt

[Robert Ransom <[e-mail]>]

On 7/29/14, Sean Turner <[e-mail]> wrote:
> At the interim CFRG meeting, I agreed to publish a draft of the curve 25519
> function with some help from Rich, Watson, and Tanja.  That draft is now up.

Some notes (this is not a thorough review):

Section 3:

* The draft correctly specifies that the high bit must be discarded,
but does not mention that that differs from the specification in the
Curve25519 paper, and does not explain the reasons for that difference
(resistance to implementation fingerprinting, and forward
compatibility with point formats which preserve the sign bit for use
in other protocols).  It should do both, so that the RFC won't be
‘corrected’ to match the paper when someone else notices that
difference five or more years from now.

* The draft correctly specifies that implementations must produce
outputs less than the field order p, but does not explicitly state
that implementations must accept inputs which are greater than or
equal to p (and silently reduce them mod p).

Section 4:

* In the second paragraph, “All calculations are done over GF(p)”
should be replaced with “All calculations are performed in GF(p)” --
“performed” is slightly more precise, and “in” is more correct than
“over” when you're operating on field elements rather than e.g.
polynomials with coefficients in the field (i.e. polynomials ‘over’
the field).


Robert Ransom