Re: [Cfrg] Adoption of draft-agl-cfrgcurve-00 as a RG document

[Ilari Liusvaara <[e-mail]>]

On Sun, Jan 18, 2015 at 11:32:57PM -0800, Robert Ransom wrote:
> 
> * Curve3617 (also known as Curve41417) has cofactor 8, and is defined
>   over a field of order congruent to 3 mod 4.  Accordingly, the curve
>   selection procedure in draft-agl-cfrgcurve-00 will choose a
>   different curve if applied to the field used for Curve3617.  (This
>   point was previously raised to CFRG in
>   <http://www.ietf.org/mail-archive/web/cfrg/current/msg05788.html>.)
> 
>   The curve selection procedure specified in draft-agl-cfrgcurve-00
>   will instead choose a curve with d > 2^19 (found by D. J. Bernstein
>   (et al. ?), found again by Mike Hamburg, and found yet again and
>   published recently by David Leon Gil), compared to d=3617 < 2^12 for
>   Curve3617.  The parameter value for the twist-secure curve with
>   cofactor 4 is so much larger than the parameter value for cofactor 8
>   that the performance of at least one implementation strategy of some
>   significance would be harmed by insisting on cofactor 4: current
>   FPGAs contain 18-bit multipliers, and d > 2^19 almost guarantees a
>   greater cost to multiply by the curve parameter.

I got d=-142113 (#E<p)  (d=142114 if one additionally requires #E>p)

These numbers are 18-bit in absolute value.

-Ilari