[Cfrg] RFC 6090 correctness

[Watson Ladd <[e-mail]>]

Dear all,

It is not obvious to me why the algorithm in appendix F.2 in RFC 6090
is correct. Why is u=0, v !=0 prohibited? In particular, given a
single y coordinate there are potentially three x coordinates in the
field with that y coordinate. When presented with two of these points,
the algorithm given then falls through to computing 2*P1, which isn't
the right answer.

Explicitly, on the curve y=(x-a)(x-b)(x-c) over any field of large
enough characteristic, adding (a,0,1) to (b,0,1) will not produce
(c,0,1), but rather the point at infinity as these are 2-torsion
points.

Sincerely,
Watson Ladd