Re: [Cfrg] [TLS] FW: New Version Notification for draft-black-numscurves-00.txt

[Brian LaMacchia <[e-mail]>]

>From: TLS [mailto:[e-mail]] On Behalf Of Watson Ladd
>Sent: Tuesday, July 01, 2014 11:08 AM
>To: [e-mail]
>Subject: Re: [TLS] [Cfrg] FW: New Version Notification for draft-black-numscurves-00.txt
>
>Is there any technical difference between 19 and 189 other then a slight change in square root calculations? 

Yes, there is.  For the NUMS curve, for each security level we
started with the largest prime smaller than 2^(security level)
congruent to 3 mod 4, which is why we use p = 2^256 - 189.  As
you point out, choosing a prime congruent to 3 mod 4 simplifies
the square root calculations, but it also means that for the
twisted Edwards curves we can find optimal cofactors of (4,4) for
the curve and its twist.  We do not expect to see significant
performance differences between modular operations implemented
with p = 2^256 -189 and p = 2^255 - 19 (the prime for
Curve25519).
 
An advantage of the NUMS construction approach is that we are
able to deterministically choose both a short Weierstrass and a
twisted Edwards curve over the same prime for the same security
level.  It seems to me that one of the questions the CFRG needs
to consider is the relative merits of the two curve types.  It's
not clear to me whether the performance improvements possible
using twisted Edwards curves outweigh the additional complexity
of moving existing codebases from short Weierstrass curves.

					--bal