[Cfrg] Safecurves draft redux

[Watson Ladd <[e-mail]>]

Dear all,
The email thread about the draft exploded and I had a lot of points to
respond to all over the place.

First off, I am including explicit formulas in the draft. It costs
nothing, and people seem to want it. I'm also explaining the benefits
of Montgomery form for x-coordinate only ECDH. I'll upload it as soon
as I'm happy with some editing I need to do.

The naming issue is fine: we can say "the safecurve Mxxx has been
found to be unsafe" without risk of being misunderstood. If there is
consensus that we should call the IANA registry something else, say
"Chicago curves", I'm not opposed to it.

But as for efficiency, pontification about what is fast and what isn't
will always be behind the drive of implementors to accelerate
everything. What seems like an awkward limb placement can be fixed by
some clever use of fractional radix arithmetic.

Lastly, just because a protocol suggests a form to go on the wire does
not mean that the calculations an implementation does need to resemble
it. Robert Ransom has made this point, and I agree with it. Good
standards specify observed behavior, not how it is attained.

As a metacomment: we shouldn't let our desire for "The Idiots Guide to
ECC" in RFC form get in the way of standardizing these curves. I don't
think our job is done with putting these curve formulas in an RFC, but
it does substantially help anyone who wants to use these curves in
another IETF protocol.

Sincerely,
Watson Ladd