Re: [Cfrg] Requirements for curve candidate evaluation update

[Mike Hamburg <[e-mail]>]

On 8/12/2014 6:14 PM, Watson Ladd wrote:
> Except the Microsoft curves send points on a twisted Edwards curve
> with a=-1, and q=3 (4), so aren't complete without using an isogeny
> and a slower formula. This is a much more serious problem, as it makes
> implementation quite a bit more complicated. If we assume implementors
> don't know crypto, then complete formulas are very necessary.
>
Presumably this is not an exhaustive list of desiderata.

If these requirements become final, then surely the complete curves mod 
the Microsoft primes with a=1 and no restriction on the sign of d 
(choose the one with q<p) should be in the running.

Cheers,
-- Mike