Re: [Cfrg] Point format for Edwards curves

[Andrey Jivsov <[e-mail]>]

On 05/16/2015 03:02 PM, Watson Ladd wrote:
> Dear all,
>
> I hope to upload version 02 of my SPAKE2 draft soon, however, I was
> hoping to have points on Ed448Goldilocks and Ed25519 in it. This can't
> currently happen because we've not decided on a point format for
> Edwards curves. The existing point formats in the CFRG draft will not
> work because I need addition. I'm aware this has taken quite a bit of
> conversation spread out, but something like a little endian y
> coordinate and sign bit of x doesn't seem to be wrong enough to not
> put forward.

The sign bit of T can also be implicit when T=wM+xG in your draft is 
required to have the positive 't_x' for T={t_x, t_y}  (or "compliant" 
T). The "encoding" of T can be done very efficiently because the sender 
chooses a random x.

https://tools.ietf.org/html/draft-jivsov-ecc-compact-05#section-4.2.3 
describes the algorithm for the sum of points.