Re: [Cfrg] Outline -> was Re: normative references

[David McGrew <[e-mail]>]

Hi Kevin, Paul, and Watson,

On 01/16/2014 02:42 PM, Igoe, Kevin M. wrote:
> Paul Lambert
> On Thursday, January 16, 2014 1:43 AM Paul Lambert wrote:
>
>> A truly ‘unified' public key system would support both signatures and
>> key establishment with the same key.
>>
> Received wisdom is that using the same key for both key establishment and
> signatures is a bad idea.  I believe the concern is that one protocol
> might be used an Oracle to subvert the other.

Agreed on that point, but there is a background issue here that I want 
to ask about.

Watson said in a previous email:
 >
 > Montgomery curves are here for their blazing speed in ECDH without 
large tables.
 > Edwards curves are here for their blazing speed in signatures where 
we can't toss out
 > one coordinate. I'ld much rather use Montgomery for ECDH and Edwards
 > for signatures than Edwards for everything.

So, what would this mean for an implementation that uses both ECDH and 
an EC signature?   That the math routines for both Edwards and 
Montgomery need to be included?    Or is translation between the formats 
very efficient?  If a single curve type and a single set of 
math/algorithms could be used for both, then an implementation could be 
simpler and more compact, and could perform better in software.

In any case, it makes sense to consider a complete system, rather than 
to optimize ECDH in isolation, and optimize a signature method in 
isolation.

David