Re: [Cfrg] Summary

[Ilari Liusvaara <[e-mail]>]

On Thu, Jan 01, 2015 at 10:50:49AM -0500, Watson Ladd wrote:
> On Thu, Jan 1, 2015 at 9:49 AM, Kurt Roeckx <[e-mail]> wrote:
> 
> Above 255 bits, life gets more interesting. Assuming we want to use
> X-coordinate Montgomery (sorry Mike) for ECDH and compressed Edwards
> for sigs, we've got 3 or 4 different proposals for around 380, and 1
> for 521.
> 
> -For 521 it's E521 as described on safecurves.cr.yp.to, the prime being 2^521-1
> -2^389-21: I've not calculated the curve yet, but I think Ilari may have
> -2^384-317: the NUMS proposal
> -2^448-2^224-1: Goldilocks, which has extremely fast arithmetic due to
> its shape.

http://www.ietf.org/mail-archive/web/cfrg/current/msg05630.html

> For signatures, NUMS proposes what I've called FrankenECDSA, and they
> call ECDSA (but isn't really): doing ECDSA but with Edwards curves.
> The other proposal is EdDSA, which is a Schnorr signature variant.
> NUMS has been open to an additional signature algorithm, and we can
> use ECDSA on an isomorphic Weierstrass curve if we really want. There
> are some differences over which of the isogenous or isomorphic Edwards
> curve to use, with NUMS using an isogenous one and the current Ed25519
> an isomorphic one.

Then there is ECDSA with Edwards public keys (which could be interpretted
as just another point format):

Replace 'r = x1 mod n'  by  'r = ((Y/X)^2 + (2-4d)/3) mod n' in both
generation and verification and calculate otherwise with Edwards curve.


-Ilari