Re: [Cfrg] Fwd: I-D Action: draft-turner-thecurve25519function-00.txt

[Ilari Liusvaara <[e-mail]>]

On Tue, Jul 29, 2014 at 04:05:04PM -0400, Sean Turner wrote:
> 
> Please review and provide comments if needed.
> 
> > 	Filename        : draft-turner-thecurve25519function-00.txt

  To compute the conditional swap in constant time (independent of s_t)
  use dummy = s_t*(x_2-x_3) x_2 = x_2 - dummy x_3 = x_3 + dummy where
  s_t is 1 or 0, or dummy = s_t & (x_2 XOR x_3) x_2 = x_2 XOR x_3 x_3 =
  x_3 XOR x_2 where s_t is regarded as the all-1 word of 255 bits.  The
  latter version is more efficient on most architectures.

The latter formulas: Where is the dummy used? And s_t can also be 0
(no swap)?

Should those formulas be:
dummy = s_t & (x_2 XOR x_3)
x_2 <- x_2 XOR dummy
x_3 <- x_3 XOR dummy

?

And that paragraph could perhaps use some reformatting.


-Ilari