Re: [Cfrg] Curve manipulation, revisited

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 30/12/2014 17:45, Watson Ladd wrote:

> We already have agreement: It's a Montgomery x-coordinate solution 
> modulo the prime 2^255-19, with the curve equal to that of
> Curve25519.

I think we are at, or very near, agreement on Curve25519 (although of
course we would need to confirm that with everyone).

> Literally the only difference is the basepoint, which is irrelevant
> to security.

Yes; that is one of the only remaining sticking points with Ben's
draft, other than the changes he's already agreed to make.

If the draft can be changed to match Curve25519's x=9 basepoint, then
yes, I think that we would have agreement to recommend Curve25519 and
the associated X25519 Montgomery-x key agreement (and people could
more or less go ahead and start rolling that out!).

It's a gratuitous incompatibility with no security justification
otherwise, which makes no sense to me.

> I strongly urge that we finish off the 128-bit level ASAP.

That I definitely agree with.

Would it be beneficial to take the 384-bit curve out of the draft for
now? Or can we relatively quickly reach agreement on something like
2^389-21? If we run with just the WF128 curve for now, we could always
follow it up later.

I'm a little concerned that the twisted-Edwards form proposed by Ben
is not Ed25519's, as that may unnecessarily complicate the discussion
about signatures - but that discussion is (despite having raised it
months ago) in any case in a much earlier phase and I'm unsure where
it'll actually end up.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJUovF0AAoJEOyEjtkWi2t6wsgQAK0rSjlB+4AbOrWK5uO0+Vma
/HubBmEE4/YaTP85N7qmw0fICLvYXxG+GzUfDzHfRN5T7chJvT6nqYRkmI/zkZL6
FZ3gE6XP3hPgLw65W3cbpgkeyfydLw6ru9dMfOdrY6qniKhDMTNlbmAE5joekuKO
EP9Dm73yN0YN4JLxO/S6WXPfsgaBeEBGszZtsfBOMIerbhCD7O5NruXUkimMw6QI
HnZs1/uK5+S9TdbhR99Wl3Kf71R8wvpKv1A+yNUC047e+j9SPJpqIiNR7LK4QXHr
1qpCSjLR0TCZwPyftXBBiNVHVJu7e8vR4OMDDnyyMcSwU4zD2w3iHRBcy1rVMu1S
uUCgMpoAcL7sGU2sr4IX2E2FJr77cTsOX8I084hbLfz2nyrefCquaaNDcKHoQxMB
LWWW19UqAQrLisENwvEdjqJ/yC0J3I9LFJ3wDgK03hyd5DGqzx6CX79lhe7x88lU
+lkfEOeKC/Epp/oRmysEs6T+QkclhoeVlWD3damFMjqDyMVnddopctuSmOhTqNJQ
dcG54u1uLlet3dtRzWNHzSimgIT7GSLiHmiyXgNub11jLh2vDGfT3bEaJq2FDXAe
zuPFinHjdD3vybSNxoF7kiyr51FkqaCS2JDP3N8GVMCWJ3kc90qCoJSnUTUFHiyf
7v9l/EI3JF2r/8EuBee9
=ljsD
-----END PGP SIGNATURE-----