Re: [Cfrg] RFC 6090 correctness

[Watson Ladd <[e-mail]>]

On Sat, Mar 15, 2014 at 1:18 PM, Watson Ladd <[e-mail]> wrote:
> Dear all,
>
> It is not obvious to me why the algorithm in appendix F.2 in RFC 6090
> is correct. Why is u=0, v !=0 prohibited? In particular, given a
> single y coordinate there are potentially three x coordinates in the
> field with that y coordinate. When presented with two of these points,
> the algorithm given then falls through to computing 2*P1, which isn't
> the right answer.
>
> Explicitly, on the curve y=(x-a)(x-b)(x-c) over any field of large
> enough characteristic, adding (a,0,1) to (b,0,1) will not produce
> (c,0,1), but rather the point at infinity as these are 2-torsion
> points.

For clarification, I meant addition as given in the RFC. The correct
answer is the third point, but the RFC gives the point at infinity.
Thanks to Tanja Lange for pointing this out.

>
> Sincerely,
> Watson Ladd