Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Benjamin Black <[e-mail]>]

On Mon, Sep 1, 2014 at 6:06 PM, Watson Ladd <[e-mail]> wrote:
>
>
> >
> > Alternatively and for the record, it seems to me that it would be
perfectly reasonable for CFRG to decide to specify only Edwards curves
(*not* twisted, just plain Edwards curves) as Mike Hamburg and others have
suggested, and leave *all* of the optimizations as implementation choices.
 So whether someone wants to use twisted Edwards curves, the Montgomery
ladder, some other improvement, etc., would be completely up to them.
>
> Which is the case anyway: your code could implement Weierstrass
> coordinates and interop with X25519. But leaving the choice of
> coordinates open isn't a possibility.
>
> The question we need to answer is what goes on the wire? That needs to
> have an answer. And how the computations take place is largely
> irrelevant, although we do need to address security considerations,
> some of which our choice of coordinates and curve influence. What's
> the difference between specifying twisted Edwards and Edwards from
> this perspective?
>

The various working groups and standards bodies have already answered the
question of what goes on the wire. The TLS request was for new curves. As
we all seem to agree implementers are and should be free to use whatever
form they wish internally as long as the external representation is fixed,
there is general support for specifying curves in Edwards form, and
existing protocols all define X/Y coordinates on the wire, then I see an
opportunity for broad consensus here.


b