Re: [Cfrg] Safecurves draft

[Robert Ransom <[e-mail]>]

On 1/9/14, Mike Hamburg <[e-mail]> wrote:

> I wonder, though, if the standard encoding of the spec should have the sign
> of the y-coordinate.  That way if we want to use the format for something
> other than ECDH -- signatures or PAKE or whatever -- we won't have to
> specify a new encoding.

I've implemented some routines that generate and use Curve25519 keys
represented as the Montgomery-form x coordinate, with the high bit
used to transmit the sign bit of the Edwards-form x coordinate.

I would still recommend distinguishing the case where the party who
generated the key did not compute the sign bit from the case where
that party did compute the sign bit, and the sign bit was 0.  That
calls for two point formats (or three if anyone wants an uncompressed
point with the whole Edwards-form x coordinate).


Robert Ransom