[Cfrg] Point compression that removes cofactor

Michael Hamburg <mike@shiftleft.org> Mon, 08 December 2014 22:40 UTC

From: Michael Hamburg <mike@shiftleft.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Message-Id: <6C2CCEB7-4421-4912-8B53-581B00C515F7@shiftleft.org>
Date: Mon, 08 Dec 2014 14:40:46 -0800
To: IRTF Crypto Forum Research Group <cfrg@irtf.org>
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/_li8LQGHIDXXODpJSUDUDUis-Xw
Subject: [Cfrg] Point compression that removes cofactor
Precedence: list

Hi CFRG,

I’m trying to cook up a point compression/encoding system which removes the cofactor of cofactor-4 Edwards, twisted Edwards, Montgomery, generalized Huff and Jacobi Quartic curves.

Hypothetically, let’s suppose that the point compression format works, and it isn’t horribly complicated or easy to screw up, and it performs almost as well as the usual compression formats, and it masks the incompleteness of the a=-1 twisted Edwards formulae.

Proponents of cofactor-1 curves, would this mitigate the problems you see in those curves?  It would still require new code, both for the curve implementations and the compression format, but would you consider it to remove your protocol-level concerns?

Cheers,
— Mike

[Cfrg] Point compression that removes cofactor Michael Hamburg