[Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

[Alexey Melnikov <[e-mail]>]

CFRG chairs are starting discussion of the next topic:

Q4: draft-irtf-cfrg-curves-01 currently contains curves in both 
Montgomery form and Edwards form. The scalar multiplication routine is 
specified using Montgomery form (and is specific to Curve25519, which 
will need to be changed given our decision to include a higher security 
level curve). Its input is a scalar and the u-coordinate of a point on a 
Montgomery-form curve; its output is the u-coordinate of a point on a 
Montgomery-form curve. The DH function builds on this routine. Do we 
want to stay with specifying the inputs and outputs in Montgomery form 
for these routines? Or do we want to switch to an alternative curve form 
and coordinate system for defining the routines? If so, which form and 
coordinate system?


[Chairs are aware that it is possible to switch back and forward between 
different curve forms and coordinate systems, with associated costs, no 
matter which form is specified for the inputs and outputs of the 
routines. But we now have to decide *which* form we want to use for 
inputs and outputs, so as to ensure interoperability between Alice and 
Bob. Chairs did not want to implicitly force the choice of Montgomery 
form/coordinates without polling the group first.]



Once this issues is settled, we will be discussing (in no particular 
order. Chairs reserve the right to add additional questions) wire 
format, byte order and signature schemes. Please don't discuss any of 
these future topics at this time.