Re: [Cfrg] RFC 6090 correctness

[Tanja Lange <[e-mail]>]

Dear all,
> > It is not obvious to me why the algorithm in appendix F.2 in RFC 6090
> > is correct. Why is u=0, v !=0 prohibited? In particular, given a
> > single y coordinate there are potentially three x coordinates in the
> > field with that y coordinate. When presented with two of these points,
> > the algorithm given then falls through to computing 2*P1, which isn't
> > the right answer.
> 
To phrase it stronger than Watson: The algorithm is wrong. It merges the
cases of adding (x1,y1) to (x2,y1) into the case of doubling (x1,y1).

The correct algorithm needs a different case distinction

if P1=infty
elif P2=infty 
elif P1=-P2
elif P1!=P2
else (which is the P1=P2) case

All the best
	Tanja