Re: [Cfrg] draft-black-rpgecc-00-.txt [was: Consensus and a way forward]

["D. J. Bernstein" <[e-mail]>]

Benjamin Black writes:
> The concerns do not apply to the twisted Edwards curve we generated, 
> only to the isogenous Montgomery curve. 

False.

Invalid-curve attacks completely break the simplest DH implementations
in Montgomery coordinates _and_ in Edwards coordinates. Rather than
blaming the implementor, we eliminate these security failures by

   * adding twist security, for both Montgomery and Edwards, and
   * switching to single-coordinate ladders.

This is the primary motivation for twist security (and a closer look,
as I've explained in detail, shows a twist-security criterion that's met
by Curve25519 and not by PinkBikeShed). This has nothing to do with the
superficial differences between the Montgomery x and the Edwards y, both
of which support ladders.

If you disagree, please explain why you're requiring _any_ type of twist
security for Edwards curves. Why aren't you saying something like "The
larger d forced by 'twist security' is a violation of rigidity" and
objecting to the whole concept of twist security for Edwards curves?

---Dan