Re: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Mar 12, 2015 at 3:53 PM, Adam Langley <[e-mail]>
wrote:

> On Thu, Mar 12, 2015 at 12:19 PM, Andrey Jivsov <[e-mail]>
> wrote:
> > I propose the Montgomery curve representation (u, v), which can be used
> for
> > signatures on the same curve.
> >
> > "u" is identical to the sec 9 of
> > https://tools.ietf.org/html/draft-agl-cfrgcurve-00.
> > "v" is calculated (at virtually no additional computational cost) as v =
> u^3
> > + 486662*u^2 + u
>
> I'm going to display my ignorance here, but if "v" can be calculated
> from just u with very little cost, why send it at all? The receiver
> could equally calculate it if useful, no?
>
> > * The format is friendly for crypto algorithms that need to add points
> (as
> > opposed to ECDH only)
>
> Wouldn't they need to know an extra bit? Given a point on the
> Montgomery curve, (u,v), the "v" value is v^2, right? Doesn't that
> discard the sign of v?
>

I don't particularly care about performance differences unless they are at
least a factor of 2.

Robustness of implementation is another matter. That should be our
priority. Do not give any information that the security of the system
depends on the receiver checking.

If the points can be calculated by the receiver quickly, let them do that.
Otherwise we risk giving an attacker leverage by specifying bad points.