Re: [Cfrg] Safecurves draft

[Watson Ladd <[e-mail]>]

On Thu, Jan 9, 2014 at 12:01 PM, Paul Lambert <[e-mail]> wrote:
>
>
>>> I agree.  The sender might well use Edwards internally -- it's about 3x
>>> faster -- but the point should be sent in Montgomery form.
> Totally undefined in the draft.  Critical for interoperability.

Whether or not Montgomery or Edwards form is used depends on what the protocol
is doing with the points. Montgomery form does not support addition,
but has advantages
in ECDH representations because it eliminates some validations without
point compression issues.

>
>
>>
>>This draft doesn't specify an encoding: it's up to whichever standard
>>uses this draft
>>to pick one.
> Wrong answer Š  we need interoperability of public key representation
> Since a key may be used in multiple applications.

Most reasonable representations can be interconverted. However, there
are popular implementations
of these curves that make strange representation choices: a format
switch might not be popular if everyone
implementing a protocol wants to use NaCl.

Furthermore, some people (like me) want fixed length encodings sized
to cover the necessary range exactly, while
others like ASN.1 (for inexplicable reasons). The fewer choices we
make here, the faster this can get through. The new version explains
what
representations should do, while leaving it up to the end user
protocols to decide what makes sense.

>
>
> Paul
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin