Re: [Cfrg] Complete additon for cofactor 1 short Weierstrass curve?

[Manuel Pégourié-Gonnard <[e-mail]>]

Hi,

On 04/12/2014 23:17, Dan Brown wrote:
> If this is all correct, then I would suggest that cofactor 1 short
> Weierstrass do not have a security problem compared to Edwards curves (e.g.
> cofactor 4), in the sense of lacking a complete addition law, but rather,
> just an efficiency problem, in the sense of not having any (known) efficient
> complete law.
> 
I'm way too tired to check if the above is correct, but it seems to me that
complete laws for general curves are known, see eg 29.1.2.a of the Handbook of
Elliptic and Hyperelliptic Curve Cryptography (Cohen, Frey et al.).

I'm not sure it makes such a lot of sense to classify that as an efficiency
rather than security issue: in my opinion (which seems to be shared by many
people), conflicts between efficiency and security are to be avoided as much as
possible, since in practice, they will very often result in security issues.

Manuel.