Re: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

[Mike Hamburg <[e-mail]>]

On 03/06/2015 03:55 AM, Ilari Liusvaara wrote:
> On Thu, Mar 05, 2015 at 11:31:01PM +0000, Alexey Melnikov wrote:
>> CFRG chairs are starting discussion of the next topic:
>>
>> Q4: draft-irtf-cfrg-curves-01 currently contains curves in both Montgomery
>> form and Edwards form. The scalar multiplication routine is specified using
>> Montgomery form (and is specific to Curve25519, which will need to be
>> changed given our decision to include a higher security level curve). Its
>> input is a scalar and the u-coordinate of a point on a Montgomery-form
>> curve; its output is the u-coordinate of a point on a Montgomery-form curve.
>> The DH function builds on this routine. Do we want to stay with specifying
>> the inputs and outputs in Montgomery form for these routines? Or do we want
>> to switch to an alternative curve form and coordinate system for defining
>> the routines? If so, which form and coordinate system?
> Montgomery u with infinity-to-zero-fold[1] for both.
>
> Basically, offers excellent combination of performance, simplicity and small
> implementation security gap.
>
>
> [1] A.k.a. what Curve25519 does. The folding actually simplifies things
> (infinity is no longer special case).
>
>
> -Ilari

+1.  Despite my love for fancy point formats, the simplicity of 
Curve25519 is very valuable.

When it comes time for signatures, though, we will need at least a sign 
bit and possibly a different format.

-- Mike