Re: [Cfrg] Fwd: I-D Action: draft-turner-thecurve25519function-01.txt

[Richard Barnes <[e-mail]>]

A few minor comments below:

"""
   Proper implementations use a
   restricted set of integers for s and only x-coordinates of points Q
   defined over GF(p).
"""
Assuming these restrictions are elaborated in detail elsewhere, a forward
reference would be helpful.


Looks like you need some line breaks here:
"""
   cswap(s_t, x_2, x_3) dummy = s_t * (x_2 - x_3) x_2 = x_2 - dummy x_3
   = x_3 + dummy Return (x_2, x_3)
"""

The document uses "leftmost" and "rightmost" to refer to bits.  It might be
clearer to refer to "most significant" and "least significant".

There are a couple of magic values that appear, a24 in Section 4 and 9 in
Section 5.  For a24, it would be helpful just to say "(see [Curve25519])"
to reinforce that this document isn't making it up.  For 9, it would be
helpful to note that this fixed value is simply the chosen base point for
Curve25519 (in the language of traditional ECDH).

"""
   Alice generates 32 random bytes in f[0] to f[31].  She masks the
   three rightmost bits of f[0] and the leftmost bit of f[31] to zero
   and sets the second leftmost bit of f[31] to 1.  This means that f is
   of the form 2^254 + 8 * {0, 1, ..., 2^(251) - 1} as a little-endian
   integer.
"""
My preference would be for this to be stated less constructively, e.g., as
"Alice generates a random integer f in the range [2^254, 2^255-8]
inclusive, such that f = 0 (mod 8).  For example ... [current procedure]".


"""
   where 9 is the number 9
"""
I assume this is "the number 9, represented as a 32-byte integer in the
little-endian representation described in Section 3"


"""
  Protocols that require contributory behavior...
"""
This phrase is new to me.  Could you expand?





On Tue, Aug 12, 2014 at 9:18 AM, Sean Turner <[e-mail]> wrote:

> Hi!
>
> Please note that we’ve submitted a new version to incorporate the comments
> received to date.
>
> The github repo is located here:
> https://github.com/seanturner/draft-turner-thecurve25519function
>
> spt
>
> Begin forwarded message:
>
> > From: [e-mail]
> > Subject: I-D Action: draft-turner-thecurve25519function-01.txt
> > Date: August 12, 2014 at 09:16:51 EDT
> > To: [e-mail]
> > Reply-To: [e-mail]
> >
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> >
> >
> >        Title           : The Curve25519 Function
> >        Authors         : Watson Ladd
> >                          Rich Salz
> >                          Sean Turner
> >       Filename        : draft-turner-thecurve25519function-01.txt
> >       Pages           : 7
> >       Date            : 2014-08-12
> >
> > Abstract:
> >   This document specifies the Curve25519 function, an ECDH (Elliptic-
> >   Curve Diffie-Hellman) key-agreement scheme for use in cryptographic
> >   applications.  It was designed with performance and security in mind.
> >   This document is based on information in the public domain.
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-turner-thecurve25519function/
> >
> > There's also a htmlized version available at:
> > http://tools.ietf.org/html/draft-turner-thecurve25519function-01
> >
> > A diff from the previous version is available at:
> > http://www.ietf.org/rfcdiff?url2=draft-turner-thecurve25519function-01
> >
> >
> > Please note that it may take a couple of minutes from the time of
> submission
> > until the htmlized version and diff are available at tools.ietf.org.
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> > _______________________________________________
> > I-D-Announce mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/i-d-announce
> > Internet-Draft directories: http://www.ietf.org/shadow.html
> > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg
>