Re: [Cfrg] Safecurves draft

[Paul Lambert <[e-mail]>]

Hi Bodo,

>>Proposal:
>> - first four characters define the curve type/equation/math/etc
>> - next 3 or more numbers are the field size
>> - next characters carry an 'r' followed by a revision indication
>>
>>curve3617 -> edwp414r1
>
>"r1" in SECG curves indicates that it's "random" curve number 1 (as opposed to "k1", which would
>be a Koblitz curve).

Thanks ... my mistake..  putting the 'type' and changing the 'r' meaning in the front was confusing

>Of course the new names don't have to look anything like SECG curve names,
Yes ...
>but if they do, that very different meaning for a very similar postfix could end up causing some
>confusion.  So I think you might want to adjust the proposal to give curve3617 a name of the
>form "...p414ed1" instead.

Much better.

I assume ... needs filling as origin of name space. Since we're on this list it could be:
   'cfrgp414ed1'
or just
  'p414ed1' or 'fp414ed1'

So far, a curve ontology -
  'r' -> Short Weierstrass (current usage always has a = p-3)
  'k' -> Koblitz (subclass of Short Weierstrass with optional optimizations)
  'ed' -> Edwards
I assume we need:
  'mo' -> Montgomery
   Others??

Brainpool curves specifically call out 't' for twisted versions of their random
Curves that are 'r' curves.  The twists have a=p-3 ... confusing when
comparing to SEC/NIST. The provenance of the numbers
seems less important the clearly identifying the curve type and applicable
math routines.


Paul




From: Bodo Moeller [mailto:[e-mail]]
Sent: Thursday, January 09, 2014 2:44 PM
To: Paul Lambert
Cc: [e-mail]
Subject: Re: [Cfrg] Safecurves draft

Paul Lambert <[e-mail]<mailto:[e-mail]>>:

This need not be an issue if the new names are clearly distinguishable
and mapped to the old names.  For example: 'secp256r1' is identical to
the later 'nistP521'

I suggest that we reuse a similar nomenclature.  It would make the new curves
look like equals in notation, provide a consistent nomenclature,
And the postfix 'r1', 'r2' notation is handy for new parameters or generator
points in the same curve/field.

Proposal:
 - first four characters define the curve type/equation/math/etc
 - next 3 or more numbers are the field size
 - next characters carry an 'r' followed by a revision indication

curve3617 -> edwp414r1

"r1" in SECG curves indicates that it's "random" curve number 1 (as opposed to "k1", which would be a Koblitz curve).  Of course the new names don't have to look anything like SECG curve names, but if they do, that very different meaning for a very similar postfix could end up causing some confusion.  So I think you might want to adjust the proposal to give curve3617 a name of the form "...p414ed1" instead.

Bodo