Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Benjamin Black <[e-mail]>]

On Mon, Sep 1, 2014 at 7:05 PM, Watson Ladd <[e-mail]> wrote:

> On Mon, Sep 1, 2014 at 6:50 PM, Benjamin Black <[e-mail]> wrote:
> >
> > The various working groups and standards bodies have already answered the
> > question of what goes on the wire. The TLS request was for new curves.
> As we
> > all seem to agree implementers are and should be free to use whatever
> form
> > they wish internally as long as the external representation is fixed,
> there
> > is general support for specifying curves in Edwards form, and existing
> > protocols all define X/Y coordinates on the wire, then I see an
> opportunity
> > for broad consensus here.
>
> The standards define short Weierstrass coordinates as what goes on the
> wire, not arbitrary pairs X,Y. Furthermore, things like the
> representability of the identity, small order points, etc. introduce
> enough differences from existing practice that one has to check
> carefully how well the specs deal with them.
>
>
In neither RFC4492 nor X9.62-1998 do I see anything that constrains X,Y
coordinate formats to being short Weierstrass only. I am aware that strict
compliance with ECDSA requires short Weierstrass, but that, too, is an
implementation detail for those electing to use the new curves. If you have
a specific section of a standard in mind, please point me to it.

The rest of your message would be good guidance to provide back to TLS-WG
along with the curves so they can correctly and securely implement them.


b