Re: [Cfrg] Signature proposal

[Ilari Liusvaara <[e-mail]>]

On Sun, Jun 21, 2015 at 08:54:59PM -0700, Watson Ladd wrote:
> 
> We write E: (-1)y^4+x^4=1+dx^2y^2 as the affine form of an Edwards
> curve, possibly twisted over p. We represent values in F_p as
> little-endian fixed width length vectors of bytes of the
> representative in {0,1,\ldots p-1}. Define a value in F_p as negative
> if its smallest representative is less than p-1/2, and positive
> otherwise. We encode a point on E as the y coordinate followed by a
> byte which is 0 if the x coordinate negative, 1 if the x coordinate
> positive. Let q be the order of the large prime subgroup of E.

Did you mean E: (-1)x^2+y^2=1+dx^2y^2? AFAIK, Usually the a twist
factor is on x, and usually the lhs terms are quadric.

Also, isn't the usual negative/positive criteria when working on
curves that are possibly of fields of size 4k+1 the LSB of the
representative? I think that might be easier to get than comparing
the coordinate with (p-1)/2.


-Ilari