Re: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

[Alexey Melnikov <[e-mail]>]

Hi,
Chairs are apologizing for the delay in closing this discussion topic.

Thank you for constructive discussion of the topic.

On 05/03/2015 23:31, Alexey Melnikov wrote:
> CFRG chairs are starting discussion of the next topic:
>
> Q4: draft-irtf-cfrg-curves-01 currently contains curves in both 
> Montgomery form and Edwards form. The scalar multiplication routine is 
> specified using Montgomery form (and is specific to Curve25519, which 
> will need to be changed given our decision to include a higher 
> security level curve). Its input is a scalar and the u-coordinate of a 
> point on a Montgomery-form curve; its output is the u-coordinate of a 
> point on a Montgomery-form curve. The DH function builds on this 
> routine. Do we want to stay with specifying the inputs and outputs in 
> Montgomery form for these routines? Or do we want to switch to an 
> alternative curve form and coordinate system for defining the 
> routines? If so, which form and coordinate system?
>
>
> [Chairs are aware that it is possible to switch back and forward 
> between different curve forms and coordinate systems, with associated 
> costs, no matter which form is specified for the inputs and outputs of 
> the routines. But we now have to decide *which* form we want to use 
> for inputs and outputs, so as to ensure interoperability between Alice 
> and Bob. Chairs did not want to implicitly force the choice of 
> Montgomery form/coordinates without polling the group first.]
Based on answers received, chairs declare rough consensus on using 
"u"-only form for DH for both curves that will be recommended by CFRG to 
IETF. Chairs took the post-March 12 discussion into consideration.
Note that this format need not be adopted for signatures.

Best Regards,
Alexey, on behalf of chairs.