Re: [Cfrg] Elliptic Curves - curve form and coordinate systems

[Michael Hamburg <[e-mail]>]

I just realized that this is attached to a poll which supposedly just ended.  That said, does anyone want to change their input to the poll?

I personally am still happy with Montgomery u for ECDH.  For non-ECDH, we can discuss further since that’s not what the poll is about, but I still prefer u with an implicit or explicit sign bit.

— Mike

PS: In my earlier email with implicit sign bit, I wrote “invert x if y isn’t positive” which of course should be “invert x if y/x isn’t positive”.

> On Mar 13, 2015, at 1:50 PM, Andrey Jivsov <[e-mail]> wrote:
> 
> When proposing uncompressed form of a point I recognize that diverse applications have opposite requirements regarding storage/computational efficiency. One way to come closer to pleasing everybody is the following:
> 
> * CFRG defines the canonical point representation as (u,v) u in Montgomery form, v=SQRT(u^3 + 486662*u^2 + u). (v might be in any other form to avoid the SQRT for the recipient.) This is a 64 byte octet string, always padded, on the wire.
> 
> * Define the compressed version as u, done with e.g. memcpy( dest_u, src_uv, is_compressed ? 32 : 64 ). In other words, the compression is done by the non-crypto code. This is easy for ECDH applications. For non-ECDH -- use "my trick" (in public domain since 2013 whatever I "invented", if any), or don't adopt the compressed form.
> 
> With this approach the support for compression and uncompressed input doesn't require changes to existing single-format APIs. The compression is trivially done outside of crypto API. The decompression is handled by the existing API (presumably by an import function), which knows that if the input is 32 bytes -- the (non-Montgomery) implementation will need to recover the second half, otherwise, it is importing a point in canonical representation.
> 
> * Each protocol selects a single format: either (u) or (u,v). I believe TLS/PKI should do (u,v). Storage security, esp. cases of encrypting to multiple recipients, bandwidth-constrained or memory-constrained applications, or keys entered by humans will prefer (u).