Re: [Cfrg] A draft merging rpgecc and thecurve25519function.

[Mike Hamburg <[e-mail]>]

On 1/1/2015 4:51 PM, Adam Langley wrote:
> (As an aside: does the existing algorithm output Curve41417, 
> Goldilocks or E-521 when given the corresponding prime? I suspect not 
> for Curve41417 since the curve/twist cofactors are {8,8} not {4,4}. 
> Goldilocks might work though.)
I believe that Goldilocks and E-521 come out of this procedure; the 
twist of Ridinghood comes out (because I restricted my parameters to #E 
< #E'); and Curve41417 does not come out because it has cofactor 8.  
These all have different generators from the Safecurves site, but that 
doesn't really matter because nobody has deployed implementations AFAIK.

Section 6.1 is fine in terms of "let's be clear that this is the 
simplest safe thing".  But you may want to switch the conditions for 
clarity/simplicity/speed.  In particular, I think only negative d can 
come out of 6.1.  Also cofactor 4 and twist cofactor 4 imply d nonsquare 
and 1-d nonsquare, so you can remove the one condition or add the other 
if you want.

Happy 2015,
-- Mike