Re: [Cfrg] (flaws with Curve25519 DH function, if one does not check the output) Re: Elliptic Curves - curve form and coordinate systems

[Watson Ladd <[e-mail]>]

On Mar 18, 2015 9:34 AM, "CodesInChaos" <[e-mail]> wrote:
>
> In fact several implementations started by ignoring the bit, then in
> an attempt to achieve consistency I convinced them to use the bit
> (conforming to the original specification) and finally after some
> discussion they changed back to ignoring it (since ignoring makes
> embedding a sign bit easier).
>
> Bernstein documents which inputs (bitstrings) you need to ignore to
> achieve contributory behaviour at:
>
> http://cr.yp.to/ecdh.html
>
> But that documentation assumes that the high bit is used. So a
> blacklist based on that documentation will accept some low order
> points with many implementations.
>

All to save one byte! Let this be a lesson for everyone. Anyway, checking
if zero comes out always works. Or don't use protocols that require
contributory behavior: I can't think of anything that absolutely does, as
in we always have alternative protocols.

Sincerely,
Watson Ladd
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg