Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Andrey Jivsov <[e-mail]>]

On 09/02/2014 02:47 PM, Stephen Farrell wrote:
> Hiya,
>
> On 02/09/14 22:37, Andrey Jivsov wrote:
>> 10% penalty in dual-key uses
> I'm not clear what you mean by this, in terms of what protocol
> it would affect.
>
> Can you give me an example of such an IETF protocol? Without
> having thought much about it, I think there are always different
> codepoints allocated for DH and signatures, and I doubt we'd
> want the same private values shared anyway, so I'm not sure
> if that's a real or a theoretical issue.
A few examples of dual-key use and a bit braader question of whether 
would want to add points as oppose to only do scalar multiplication.

Some TLS server side fixed-base optimization will benefit from point 
addition.

While OpenPGP RFC 4880 has a concept of a "bundle of keys" things are 
easier when the top key can have both encryption and signing capability. 
There are products that add X.509 certs to PGP keys.

Signing a certificate request for a DH key to prove key possession.

Protocols for applications with space-saving requirements : keys on URLs 
or e-mail aliases, pre-generate keys "for everybody" to represent 
identities. Keys that are handled by humans (e.g. typed in base32 
encoding), etc