Re: [Cfrg] Chopping out curves

[Robert Ransom <[e-mail]>]

On 1/17/14, Alyssa Rowan <[e-mail]> wrote:

> There are arguments in favour of both the existing or a new basepoint for
> t25519 (which is what I'll call the twisted Edwards representation of
> Curve25519 used in Ed25519, as I'm not sure it actually has a name of its
> own?).

The curve specified as ‘T25519’ (a=121666, d=121665) in
draft-ladd-safecurves-03 is something that Watson Ladd made up.  The
Ed25519 signature scheme paper
(<http://ed25519.cr.yp.to/ed25519-20110926.pdf>) specifies the a=-1
form (a=-1, d=-121665/121666).

> Generating a new basepoint for t25519:
> • Elegant; we can select minimum y that satisfies SafeCurves criteria
>   - What advantage, really, would that give in implementation?
>   - Is it worth any perceived benefit?
>   - Absolute rigidity would be critical to avoid potential manipulation
> concerns

Watson Ladd actually chose a point with small Edwards-form x, not
small Edwards-form y.

There is no benefit to choosing a new basepoint, but there's also no
benefit to using ‘T25519’ instead of the (more efficient) form
specified for Ed25519.

As you point out, using a different basepoint does prevent use of keys
in different protocols, even when the protocols are designed to be
safe to use with the same key material, so that's a real (and
unnecessary) cost.

> • Reverification necessary, I think.
>   - New basepoint → new prime order → new primality tests for SafeCurve
> script? (Damn. They're the expensive part.)

‘T25519’ is isomorphic to Curve25519, so any non-identity group
element of odd order on T25519 generates the same group as the
standard basepoint of Curve25519 (and has the same order).

> On balance I have to say, I think I prefer keeping the basepoint Ed25519
> already uses for t25519, but it's not a strong preference. If we do change
> it, we do need to dot the i's and cross the t's, so to speak.

I have a strong preference for throwing out T25519 and using Ed25519
with its standard basepoint.


Robert Ransom