Re: [Cfrg] tentative agenda for CFRG at IETF 89

[David McGrew <[e-mail]>]

On 02/28/2014 11:16 PM, Robert Ransom wrote:
>
> What is your objection to using the Curve25519 paper as a normative
> reference for the standard Curve25519 scalar multiplication function?
>
>


That it is not clear or precise enough.   Specifically, it is not 
written so that a hardware or software engineer would know how to 
implement it, and it describes multiple alternatives rather than a 
single specific algorithm.

Let me point out some examples from the end of Section 2 of 
http://cr.yp.to/ecdh/curve25519-20060209.pdf, where the document 
actually defines the curve function: "By Theorem 2.1, there is a unique 
integer s .... with the following property: s = X0(nQ) .... Note that 
Curve25519 is not surjective: in particular, its final output bit is 
always 0 and need not be transmitted."   Engineers will be confused by 
the lack of an imperative description of the function, and will not know 
whether to expect the last bit to be transmitted or not.

It would be a disservice to the community to not offer implementers a 
more usable description.   If the curve is worth using, it is worth a 
draft that specifies it.

Or perhaps there was another document about the curve that you had in mind?

David