Re: [Cfrg] When's the decision?

[Ilari Liusvaara <[e-mail]>]

On Fri, Oct 17, 2014 at 04:42:09AM -0400, Parkinson, Sean wrote:
> While I still think that X25519 has speed and implementation simplicity
> advantages over numsp256t1, the fact that it can only be used for key
> exchange makes it difficult to recommend - you need another curve
> implementation anyway.

One can transform it to forms that support signatures, sharing the
base field implementation, which is by far the most annoying
part.

Unfortunately, all known EC signatures also require scalar field,
which is even more annoying to implement than base field (and
one can't use generic bignums there).

ECDSA is practicularly annoying here, because it needs inversion
in scalar field for signing. E.g. ECGDSA does not.

IIRC, The MS ECCLIB software (at least 1.1) does not implement
the corresponding scalar fields.


I earlier posted a message that gave list of suggested
operations. That also included fair amount of scalar field
operations (in order to support various ECC protocols).


-Ilari