[Cfrg] A note on how to (pre-)compute a ladder

[Francisco Rodriguez- Henriquez <[e-mail]>]

Dear CFRG community,

We would like to draw your attention to our IACR pre-print entitled,

"A note on how to (pre-)compute a ladder
Improving the performance of X25519 and X448"

https://eprint.iacr.org/2017/264.pdf.

For the point multiplication computation Q = kP, this note describes a 
right-to-left version of the Montgomery ladder, which is amenable for 
pre-computing multiples of the base point P. By requiring very modest 
memory resources and a small implementation effort, it obtains noticeable
performance improvements with respect to the RFC 7748 classical ladder 
procedure.

We stress that our proposal fully complies with the RFC 7748 
specification, in the sense that given any arbitrary secret keys of Alice 
and Bob, our ladder generates exactly the same public keys that an 
implementation of the RFC 7748 would output.

As a way of illustration, in Appendix B of our note, we include a magma 
script, which given Alice and Bob private keys of RFC7748 Sec. 6.2, it 
computes the same public keys as specified in that document.

We would be delighted to receive feedback (including sightings of typos) 
from the CFRG community.

With best regards,

Thomaz Oliveira, Julio López and Francisco Rodríguez-Henríquez