Re: [Cfrg] Chopping out curves

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 17/01/2014 14:33, Robert Ransom wrote:
> Watson Ladd actually chose a point with small Edwards-form x, not 
> small Edwards-form y. […] ‘T25519’ is isomorphic to Curve25519, so 
> any non-identity group element of odd order on T25519 generates the
> same group as the standard basepoint of Curve25519 (and has the 
> same order).

Ah, thankyou. I missed that (and had mistakenly assumed he'd go for
small y to match the Edwards curves).

Clearly, I haven't had enough tea today!


On 17/01/2014 14:33, Robert Ransom wrote:
> There is no benefit to choosing a new basepoint, but there's also 
> no benefit to using ‘T25519’ instead of the (more efficient) form 
> specified for Ed25519.

On 17/01/2014 15:17, Watson Ladd wrote:
> On reflection the a=-1, d=-121665/121666 form saves an an
> addition, but the multiplication is by a bigger number in the
> complete form. Anyway, I don't have strong thoughts on the matter.

Well then, there's little or no benefit in specifying a new form when
we already have the Ed25519 parameters ready-made and people already
have routines working with it?


On 17/01/2014 14:33, Robert Ransom wrote:
>> I have a strong preference for throwing out T25519 and using 
>> Ed25519 with its standard basepoint.

On 17/01/2014 15:17, Watson Ladd wrote:
> I'll follow that preference, but ugh, the number in front of
> x^2y^2 is big.

If it doesn't really have a performance impact in practice, it's no
big deal.

Ed25519 it seems to be, then. Though, that said, the name might be
confusing. Maybe we'd better call that form something else.

Perhaps: 'te25519', for Twisted Edwards (2^255)-19?

(Deliberately referring to the curve names in lower-case. Thinking
ahead to when people put these things on command-lines or config files
and argue about capitalisation; none of the other curves in IETF
protocols get capitals.)

• If we called it 't25519', people might confuse it with the one in the
  draft here.

• But if we call it 'Ed25519', people might confuse it with the whole
  Ed25519 signature scheme.

  (Sure it's used _in_ that signature scheme, although it seems likely
  to me at this stage that we might be heading more in the general
  direction of a cleaner, fresher version which works with te25519,
  curve3617 and e521, and quite possibly uses a new hash. Demand seems
  stronger for curve25519 ECDHE first, however.)

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJS2X1EAAoJEOyEjtkWi2t6tR0QALl42L1yV84EFgckps6R2rOe
30UOcOWx1XZGnU/Kdwt0w7YP8SvUbAtX97RgVlcgWQbG9CyYldELJ/39lZw7uyFF
iNyNmIGYvXdrlxpWTNMry0lB8SLjZts+RJX0/ZcDD0qguGnmsP+IHUH7Q80hsjJ0
CB9rvVVfuuAmDU5pWWOWHt8hEVhX9jl7vRuF4Yb51ngqHrS/NpasK2qaZ88Gw4Fp
ns/b8OzZNoChxkAHYBlGVrkuCq6O9d8gpRaoxkl0ujsndvsZlQ2ud0FhVg/FXcRs
le6YCig5rEuEoS/XwGUc4Mb6Py2BRJZ4C0Ax6ZTP1pOzH8OhwKskuEeLe7SVvKGu
WhC5hgGz/Sub1nKBI/mTZNwZrY5kjEzg21iZ1kIbpK37V59TwplLOJzu/aalXDbU
Sq0U1aW73Y6p+KSQKsGpSfeUpmY/6e19emoUQRbZ9J1eER/o2vjPAJcCmv+zfugx
uE2moiZoc1mfCV5E7wIxZvUrU5bPk4ARSzHxhw7o/higqc/PZbtosFKEqeRBOz1I
paqlewTRs7tQTwoSx9mn3+dln47Kz2y18pBAUM7BitUyWghMoJRq6Mm6crKkGG2O
f2ZAkmKDlpEuLix9/ENlmGDl2i9ZXH7tALnOeYZ/txlFtagpUBSdLWSBGo0erEwp
Q0AWcvz2wr81lOwpPuBq
=w0/6
-----END PGP SIGNATURE-----