Re: [Cfrg] Point format for Edwards curves

[Nico Williams <[e-mail]>]

On Sun, May 17, 2015 at 08:56:20PM -0700, Andrey Jivsov wrote:
> On 05/16/2015 03:02 PM, Watson Ladd wrote:
> >I hope to upload version 02 of my SPAKE2 draft soon, however, I was
> >hoping to have points on Ed448Goldilocks and Ed25519 in it. This can't
> >currently happen because we've not decided on a point format for
> >Edwards curves. The existing point formats in the CFRG draft will not
> >work because I need addition. I'm aware this has taken quite a bit of
> >conversation spread out, but something like a little endian y
> >coordinate and sign bit of x doesn't seem to be wrong enough to not
> >put forward.

Sure.

> The sign bit of T can also be implicit when T=wM+xG in your draft is
> required to have the positive 't_x' for T={t_x, t_y}  (or
> "compliant" T). The "encoding" of T can be done very efficiently
> because the sender chooses a random x.

Even better.

> https://tools.ietf.org/html/draft-jivsov-ecc-compact-05#section-4.2.3
> describes the algorithm for the sum of points.

There's a timing variation, but it's entirely to do with the sums of
randomly selected points, not the fixed point derived from the password,
which means there's no side channel.  Very nice.

Nico
--