Re: [Cfrg] Point format endian (was: Adoption of draft-ladd-spake2 as a RG document)

[Damien Miller <[e-mail]>]

On Sun, 25 Jan 2015, Mike Hamburg wrote:

> I think that this is actually an interesting question, so maybewe can
> put aside religion and mockery thereof for little bit...
>
> Does anyone know of existing code which processes cryptography over
> multiple fields using a generic bignums package (hopefully with
> fixed-size bignums for timing resistance), and would be complicated by
> inconsistent endian practices in a new curve? If so, it might be worth
> considering a consistent endian.

We (OpenSSH) adopted the little-endian encoding from djb's ECDH
curve25519 and Ed25519 as specified despite all other SSH wire bignums
being encoded as big endian. We were happy to be able to use the
existing high quality and well-reviewed implementations. This more than
justified the small inconsistency.

The inconsistency is really just minor aesthetics - the wire values
are opaque to everything but the implementation of the primitives
themselves; it doesn't matter to the application at all.

-d