Re: [Cfrg] Elliptic Curves - curve form and coordinate systems

[Nico Williams <[e-mail]>]

On Mon, Mar 16, 2015 at 01:04:43AM -0700, Andrey Jivsov wrote:
> The protocols that cannot afford a few additional lines of code like
> in the diff https://github.com/brainhub/curve25519-donna/commit/abc601836b75ba6399c775842647e0f3b66061c4
> might standardize on u only ( as I wrote in
> http://www.ietf.org/mail-archive/web/cfrg/current/msg06480.html ). I
> would like to hear more about these protocols, though.
> 
> On the Internet in general (YouTube, Netflix streaming) and TLS in
> particular, it's hard to see that ~32 bytes per (not reused)
> handshake matter. This part of the Internet is currently using
> uncompressed points and RSA.

If all the protocol is going to do with ECC is ECDH with ephemeral keys,
then no, there's no point at all to doing anything other than x-only.

For ECDH-only, x-only will do, always.  It's only when combining with
other primitives using the same ECC key that there's any need or win to
using more than x-only.  If that's desired, then define a (here: X25519)
curve's public key representation as: x-only for ECDH-only, and some
other form for the other cases.

Nico
--