Re: [Cfrg] On why point and APIs formats matter (Re: Submission of curve25519 to NIST from CFRG -> was RE: On "non-NIST")

[Nico Williams <[e-mail]>]

On Thu, Mar 12, 2015 at 11:40:35AM +0000, Dan Brown wrote:
> Anyway, I slightly prefer the old formats, but don't mind adjusting
> them on a per curve basis, or perhaps per hash/KDF/signature_alg, if
> people say that's easy. [...]

The ECDH Curve25519 point representation doesn't work for signatures.
That same curve can be used with signatures in the Edwards form, but
we're calling it a different curve for this purpose.  So Curve25519 has
one point representation, and Ed25519 has another, even though they are
the same curve.  That's fine.

(Code duplication here is not a concern: it's either that or point
representation conversion code, and either way there's plenty of storage
for code like this in most every application.  Micro SDcards nowadays
are a complete computer, complete with RAM and flash storage for the
code run and state kept.)

>                   [...] It kinda precludes an old generic curve
> implementation being able to talk Curve25519 with a new
> implementation, but maybe that's what's wanted, anyway.

Neither that nor the opposite is nor should be a goal.  This is
icing-on-cake territory.  ECC implementations tend to be highly
optimized for each curve.  Genericity went out the window naturally, and
that's OK.

Mind you, if someone wants genericity, they can have it: just keep a
table of curve point representations and conversions.  That's not unlike
having codepoint assignments for Oakley MODP groups, just bigger tables,
and only slightly more code (after all, there's already a variety of
point representations to support generically, as you listed them).  It's
just not a big deal, but it does mean change for an "old generic curve
implementation", but that's not a breaking change.  Whereas changing
Curve25519's point representation would be a breaking change.

Codepoint assignments for standardized groups/curves are a very useful
thing from the points of view just about everyone.  We then start
talking about "groups" and "curves" as the registered objects rather
than the mathematical objects -- a small price to pay for the
convenience of codepoint assignments.

Nico
--