Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Watson Ladd <[e-mail]>]

On Mon, Sep 1, 2014 at 6:50 PM, Benjamin Black <[e-mail]> wrote:
> On Mon, Sep 1, 2014 at 6:06 PM, Watson Ladd <[e-mail]> wrote:
>>
>>
>> >
>> > Alternatively and for the record, it seems to me that it would be
>> > perfectly reasonable for CFRG to decide to specify only Edwards curves
>> > (*not* twisted, just plain Edwards curves) as Mike Hamburg and others have
>> > suggested, and leave *all* of the optimizations as implementation choices.
>> > So whether someone wants to use twisted Edwards curves, the Montgomery
>> > ladder, some other improvement, etc., would be completely up to them.
>>
>> Which is the case anyway: your code could implement Weierstrass
>> coordinates and interop with X25519. But leaving the choice of
>> coordinates open isn't a possibility.
>>
>> The question we need to answer is what goes on the wire? That needs to
>> have an answer. And how the computations take place is largely
>> irrelevant, although we do need to address security considerations,
>> some of which our choice of coordinates and curve influence. What's
>> the difference between specifying twisted Edwards and Edwards from
>> this perspective?
>>
>
> The various working groups and standards bodies have already answered the
> question of what goes on the wire. The TLS request was for new curves. As we
> all seem to agree implementers are and should be free to use whatever form
> they wish internally as long as the external representation is fixed, there
> is general support for specifying curves in Edwards form, and existing
> protocols all define X/Y coordinates on the wire, then I see an opportunity
> for broad consensus here.

The standards define short Weierstrass coordinates as what goes on the
wire, not arbitrary pairs X,Y. Furthermore, things like the
representability of the identity, small order points, etc. introduce
enough differences from existing practice that one has to check
carefully how well the specs deal with them.

Sincerely,
Watson Ladd