Re: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

[Ilari Liusvaara <[e-mail]>]

On Thu, Mar 05, 2015 at 11:31:01PM +0000, Alexey Melnikov wrote:
> CFRG chairs are starting discussion of the next topic:
> 
> Q4: draft-irtf-cfrg-curves-01 currently contains curves in both Montgomery
> form and Edwards form. The scalar multiplication routine is specified using
> Montgomery form (and is specific to Curve25519, which will need to be
> changed given our decision to include a higher security level curve). Its
> input is a scalar and the u-coordinate of a point on a Montgomery-form
> curve; its output is the u-coordinate of a point on a Montgomery-form curve.
> The DH function builds on this routine. Do we want to stay with specifying
> the inputs and outputs in Montgomery form for these routines? Or do we want
> to switch to an alternative curve form and coordinate system for defining
> the routines? If so, which form and coordinate system?

Montgomery u with infinity-to-zero-fold[1] for both.

Basically, offers excellent combination of performance, simplicity and small
implementation security gap.


[1] A.k.a. what Curve25519 does. The folding actually simplifies things
(infinity is no longer special case).


-Ilari