Re: [Cfrg] Safecurves draft

[Mike Hamburg <[e-mail]>]

On Jan 9, 2014, at 7:26 AM, Bodo Moeller <[e-mail]> wrote:

> Robert Ransom <[e-mail]>:
> 
> > So while the Montgomery-form Curve25519 certainly has its use, allowing
> > applications to negotiate a different form for ECDH would be beneficial.
> 
>  
> Even if the party which generates a public key uses Edwards-form
> points internally for that operation, whoever generates the key can
> put it into Montgomery form for free before scaling, whereas whoever
> receives it would need to perform an extra coordinate inversion in
> order to convert from Edwards form to affine Montgomery form.
> 
> That's a good point.  As I've pointed out (or tried to point out, anyway), the receiver might want to do the computations in Edwards form too, but there's not that much to be gained from that, so it may not be worth the extra complexity.
> 
> Bodo

I agree.  The sender might well use Edwards internally -- it's about 3x faster -- but the point should be sent in Montgomery form.

I wonder, though, if the standard encoding of the spec should have the sign of the y-coordinate.  That way if we want to use the format for something other than ECDH -- signatures or PAKE or whatever -- we won't have to specify a new encoding.

An overly-complicated but cute solution is 1/sqrt(x) chosen with the same sign as y.  (x is always square if you're in the q-torsion; 1/x works just as well as x in the ladder; 1/x lets you encode the identity.)  But we probably don't actually want to spec that.  Maybe just a bit for sign(y)?

-- Mike