Re: [Cfrg] Chopping out curves

On Fri, Jan 17, 2014 at 6:33 AM, Robert Ransom <rransom.8774@gmail.com> wrote:
> On 1/17/14, Alyssa Rowan <akr@akr.io> wrote:
>
>> There are arguments in favour of both the existing or a new basepoint for
>> t25519 (which is what I'll call the twisted Edwards representation of
>> Curve25519 used in Ed25519, as I'm not sure it actually has a name of its
>> own?).
>
> The curve specified as ‘T25519’ (a=121666, d=121665) in
> draft-ladd-safecurves-03 is something that Watson Ladd made up.  The
> Ed25519 signature scheme paper
> (<http://ed25519.cr.yp.to/ed25519-20110926.pdf>) specifies the a=-1
> form (a=-1, d=-121665/121666).

Actually the curve is from the 2009 Twisted Edwards paper of Lange and
Bernstein.
On reflection the a=-1, d=-121665/121666 form saves an an addition,
but the multiplication
is by a bigger number in the complete form. Anyway, I don't have
strong thoughts on the matter.
>
>> Generating a new basepoint for t25519:
>> • Elegant; we can select minimum y that satisfies SafeCurves criteria
>>   - What advantage, really, would that give in implementation?
>>   - Is it worth any perceived benefit?
>>   - Absolute rigidity would be critical to avoid potential manipulation
>> concerns

All points in [q] have random self reducible DDH problem. The only
>
> Watson Ladd actually chose a point with small Edwards-form x, not
> small Edwards-form y.
>
> There is no benefit to choosing a new basepoint, but there's also no
> benefit to using ‘T25519’ instead of the (more efficient) form
> specified for Ed25519.
>
> As you point out, using a different basepoint does prevent use of keys
> in different protocols, even when the protocols are designed to be
> safe to use with the same key material, so that's a real (and
> unnecessary) cost.

>
>> • Reverification necessary, I think.
>>   - New basepoint → new prime order → new primality tests for SafeCurve
>> script? (Damn. They're the expensive part.)
>
> ‘T25519’ is isomorphic to Curve25519, so any non-identity group
> element of odd order on T25519 generates the same group as the
> standard basepoint of Curve25519 (and has the same order).
>
>> On balance I have to say, I think I prefer keeping the basepoint Ed25519
>> already uses for t25519, but it's not a strong preference. If we do change
>> it, we do need to dot the i's and cross the t's, so to speak.
>
> I have a strong preference for throwing out T25519 and using Ed25519
> with its standard basepoint.

I'll follow that preference, but ugh, the number in front of x^2y^2 is big.
>
>
> Robert Ransom
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg


-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin