Re: [Cfrg] ECC mod 8^91+5

[Dan Brown <[e-mail]>]

Clarifying a few things over my previous message:
- 8^91+5 has fast modular reduction mainly due its being close to a power of 2 (in contrast to 7^98-2).
- 8^91+5 is a little further than I first thought from the specifics of Koblitz-Menezes Example 5, because the conductor seems to have several more prime factors, rather than the single prime in the KM construction - sorry if I gave the wrong impression.  Perhaps portions of the KM example 5 argument might yet apply to 2y^2=x^3+x/GF(8^91+5).
- 8^91+5 as a field size might be a little awkward.  For ECDH, we take advantage of the endomorphism (x,y)->(-x,iy), to drop a sign bit from x.  This fits x into 34 bytes.  This is larger than the usual 128-bit secure ECC curves, which can use 32 bytes, so they require extra data to send and store.  The byte length is not a multiple of 4, let alone power of two, but I am not sure how much trouble that would be.