Re: [Cfrg] Summary

Ilari Liusvaara <ilari.liusvaara@elisanet.fi> Thu, 01 January 2015 19:55 UTC

Return-Path: <ilari.liusvaara@elisanet.fi>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D45E1A6FF2 for <cfrg@ietfa.amsl.com>; Thu, 1 Jan 2015 11:55:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aS0Qj5gdXrgO for <cfrg@ietfa.amsl.com>; Thu, 1 Jan 2015 11:55:47 -0800 (PST)
Received: from emh04.mail.saunalahti.fi (emh04.mail.saunalahti.fi [62.142.5.110]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14D5A1A6FED for <cfrg@irtf.org>; Thu, 1 Jan 2015 11:55:46 -0800 (PST)
Received: from LK-Perkele-VII (a88-112-44-140.elisa-laajakaista.fi [88.112.44.140]) by emh04.mail.saunalahti.fi (Postfix) with ESMTP id 3D6801A2638; Thu, 1 Jan 2015 21:55:44 +0200 (EET)
Date: Thu, 1 Jan 2015 21:55:43 +0200
From: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
To: Watson Ladd <watsonbladd@gmail.com>
Message-ID: <20150101195543.GA17155@LK-Perkele-VII>
References: <20150101144926.GA4784@roeckx.be> <CACsn0ckip8ZK=wYEAPJGAxwxBEBkXkSJQi9uPZQ7dmXPo77bGQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <CACsn0ckip8ZK=wYEAPJGAxwxBEBkXkSJQi9uPZQ7dmXPo77bGQ@mail.gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/NkqDaS4z7TYDgmRbHEebifIFfBE
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] Summary
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 01 Jan 2015 19:55:50 -0000

On Thu, Jan 01, 2015 at 10:50:49AM -0500, Watson Ladd wrote:
> On Thu, Jan 1, 2015 at 9:49 AM, Kurt Roeckx <kurt@roeckx.be> wrote:
> 
> Above 255 bits, life gets more interesting. Assuming we want to use
> X-coordinate Montgomery (sorry Mike) for ECDH and compressed Edwards
> for sigs, we've got 3 or 4 different proposals for around 380, and 1
> for 521.
> 
> -For 521 it's E521 as described on safecurves.cr.yp.to, the prime being 2^521-1
> -2^389-21: I've not calculated the curve yet, but I think Ilari may have
> -2^384-317: the NUMS proposal
> -2^448-2^224-1: Goldilocks, which has extremely fast arithmetic due to
> its shape.

http://www.ietf.org/mail-archive/web/cfrg/current/msg05630.html

> For signatures, NUMS proposes what I've called FrankenECDSA, and they
> call ECDSA (but isn't really): doing ECDSA but with Edwards curves.
> The other proposal is EdDSA, which is a Schnorr signature variant.
> NUMS has been open to an additional signature algorithm, and we can
> use ECDSA on an isomorphic Weierstrass curve if we really want. There
> are some differences over which of the isogenous or isomorphic Edwards
> curve to use, with NUMS using an isogenous one and the current Ed25519
> an isomorphic one.

Then there is ECDSA with Edwards public keys (which could be interpretted
as just another point format):

Replace 'r = x1 mod n'  by  'r = ((Y/X)^2 + (2-4d)/3) mod n' in both
generation and verification and calculate otherwise with Edwards curve.


-Ilari