Re: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

[Watson Ladd <[e-mail]>]

On Mar 5, 2015 3:31 PM, "Alexey Melnikov" <[e-mail]> wrote:
>
> CFRG chairs are starting discussion of the next topic:
>
> Q4: draft-irtf-cfrg-curves-01 currently contains curves in both
Montgomery form and Edwards form. The scalar multiplication routine is
specified using Montgomery form (and is specific to Curve25519, which will
need to be changed given our decision to include a higher security level
curve). Its input is a scalar and the u-coordinate of a point on a
Montgomery-form curve; its output is the u-coordinate of a point on a
Montgomery-form curve. The DH function builds on this routine. Do we want
to stay with specifying the inputs and outputs in Montgomery form for these
routines? Or do we want to switch to an alternative curve form and
coordinate system for defining the routines? If so, which form and
coordinate system?
>
>
> [Chairs are aware that it is possible to switch back and forward between
different curve forms and coordinate systems, with associated costs, no
matter which form is specified for the inputs and outputs of the routines.
But we now have to decide *which* form we want to use for inputs and
outputs, so as to ensure interoperability between Alice and Bob. Chairs did
not want to implicitly force the choice of Montgomery form/coordinates
without polling the group first.]
>
>
>
> Once this issues is settled, we will be discussing (in no particular
order. Chairs reserve the right to add additional questions) wire format,
byte order and signature schemes. Please don't discuss any of these future
topics at this time.

If we specify the input as Montgomery form, how do we specify the wire
format separately?

Sincerely,
Watson Ladd
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg