[Cfrg] draft-irtf-cfrg-curves question

["Jim Schaad" <[e-mail]>]

In the process of going through an implementation and dealing with the
latest set of questions about non reduced public keys, I ended up with a
question that has some implementations

If the public key I am given has not be reduced, then I compute

K_B' = K_B mod p

Now when I run the KDF function, I am supposed to include K, K_A and K_B in
the key derivation step.  The question is should I be using K_B or K_B'?

Given that the reduction is described as being computed by the routine
computing K, I would think that using K_B makes more sense as K_B' would not
normally be returned from that function.  However it does mean that there
are going to be two different values of K_B that compute the same K and one
needs to make sure that one never computes and saves K_B' and start
distributing it as it would then be potentially impossible to compute the
correct KDF result.

Does this mean that we need to have stronger language on only sending K_B'
rather than K_B when encoding public keys?

Jim