Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Andrey Jivsov <[e-mail]>]

On 09/02/2014 08:33 AM, Stephen Farrell wrote:
> Main point is: I don't believe wire-format issues make any
> difference when picking new curves.

If this refers to which tag to use (i.e. 02, 03, 04 in SEC1), no tag at 
all, endianess, or even point compression, then I can see this.

However, the actual bytes representing a point imply a 10% penalty in 
dual-key uses for "another use" due to the inversion in F(p) (and 
possibly double inversion).

If the format is selected to favour variable base ECDH (Montgomery X), 
there is a 10% penalty to perform digital signature with this key or 
some server-side optimization that depend on the ability to add two points.

The reverse of this is true if the coordinates are on the Edwards curves.

At least this is what follows from 
http://www.ietf.org/mail-archive/web/cfrg/current/msg04996.html, 
http://www.ietf.org/mail-archive/web/cfrg/current/msg05035.html, if the 
types of the curves under consideration are Montgomery and -1 twisted 
Edwards.

If it's possible to reduce this penalty for some curves and encodings, 
performance and security being equal, this is a plus for these curves 
(even though the encoding issue will formally be decided later).