Re: [Cfrg] Complete additon for cofactor 1 short Weierstrass curve?

It's completely irrelevant in practice. Multiplying points by 4 or 8
before hashing and after subtracting for equality checks produces a
prime order group without the efficiency loss inherent to these
formulas. Furthermore, applications we have today only rely on ECDH
and signatures, both of which are specified with arbitrary cofactor in
NIST standards, for instance.

On Mon, Nov 2, 2015 at 10:49 AM, Dan Brown <dbrown@certicom.com> wrote:
> http://ia.cr/2015/1060
>
> seems to finally have more efficient answers to the old questions above and
> below.
>
>> -----Original Message-----
>> From: Samuel Neves [mailto:sneves@dei.uc.pt]
>> Sent: Monday, December 08, 2014 4:11 PM
>> To: Dan Brown; 'cfrg@irtf.org'
>> Subject: Re: [Cfrg] Complete additon for cofactor 1 short Weierstrass
> curve?
>>
>> On 08-12-2014 18:46, Dan Brown wrote:
>> > Regarding that proviso, I wonder how much the second Bosma-Lenstra
>> > formula (the one I called (G:H:I), which is the one that corresponds
>> > to the line
>> > (0:1:0) in the Bosma-Lenstra paper) would be slower than the standard
>> > incomplete formula.  That is, has anybody tried to optimize it?
>> > (Naively, with a small a_4, I get a cost of 51M, but I expect much
>> > better is
>> > possible.)  Also, there seems to be many k-complete formula per curve,
>> > and perhaps some are faster than others, is this studied?
>>
>> Both Arene-Kohel-Ritzenhaler (https://arxiv.org/abs/1102.2349, Remark 4.4)
>> and Bos-Costello-Longa-Naehrig (https://eprint.iacr.org/2014/130, pg 37)
>> present simplified formulas, both beating 51M. I don't know of other
> attempts
>> to optimize complete Weierstrass formulas.
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.