Re: [Cfrg] Curve manipulation, revisited

[Michael Hamburg <[e-mail]>]

> On Dec 29, 2014, at 9:14 AM, Benjamin Black <[e-mail]> wrote:
> Had Dan been insisting that ladders be _allowed_ then I would agree with you, as I have said the same (in the line just before the part you quoted, even). What Dan said is that single-coordinate ladders are _required_.

[…]

> My point was that space/time trade-offs like that seem to be acceptable or unacceptable to Dan depending on what is being argued.

That’s because Dan has been arguing the opposite of what you claim he’s arguing.

You claim he said that only one implementation strategy — ladders —is acceptable.  But in fact, he’s been arguing that the curve/encoding/protocol should be chosen so that multiple implementation strategies — ladders, combs, whatever — will be possible.

That way, an implementor can decide what trade-offs are acceptable for his or her own implementation.  And if we make an especially good choice of curve/encoding/protocol, most of those trade-offs can be good choices instead of pitfalls.

— Mike