Re: [Cfrg] Complete additon for cofactor 1 short Weierstrass curve?

[Michael Hamburg <[e-mail]>]

> On Nov 4, 2015, at 11:08 AM, Watson Ladd <[e-mail]> wrote:
> 
> On Wed, Nov 4, 2015 at 12:41 PM, Dan Brown <[e-mail]> wrote:
>> 
>>> -----Original Message-----
>>> From: Watson Ladd
>>> Sent: Monday, November 02, 2015 11:21 AM
>>> 
>>> It's completely irrelevant in practice.
>> [DB] Seems a tad overstated. How about: too little, too late.
>> 
>>> Multiplying points by 4 or 8 before
>>> hashing and after subtracting for equality checks produces a prime order
>> group
>>> without the efficiency loss inherent to these formulas.
>> 
>> Cofactor-1 curves obviate the need for cofactor-multiplication (e.g.
>> multiplying by 4 or 8). In that regard, they improve implementation-fault
>> tolerance: one less thing for an implementer to get wrong - similar in
>> principle to using twist-security or pseudo-randomized signatures.  The
>> efficiency loss you mention is now quite a tolerable loss, due to this new
>> paper.  Given the relatively tolerable efficiency, the deciding question
>> should be about security.
> 
> An implementor who removes a multiplication by 4 where it matters will
> get the wrong result and the keys they derive will fail to agree with
> the other end. An implementor who uses incomplete formulas is not
> guaranteed to notice.

[MH]: I agree with [DB] that this paper is useful, but unlikely to be widely deployed because of its speed penalty vs the unsafe method.  But for general-purpose libraries and niche protocols that really can’t guarantee safety with non-unified formulas, this is an important step forward.  It may not quite level the playing with Edwards, but at least it avoids a potentially show-stopping problem with prime-order curves.

Cheers,
— Mike