Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

[Johannes Merkle <[e-mail]>]

Alyssa Rowan wrote on 07.07.2014 15:14:
> Well, yes - combined with an unusual ladder choice (which one might choose for constant-time, albeit not the best
> choice now) and a critical but easily-overlooked omission.
> 
> I appreciate there's not much we can do about implementers screwing up badly - but if we do have two primitives of
> about equal value and one fails catastrophically to a simple mistake that another does not, then as a matter of
> defence in depth, I'd generally prefer the more resilient one?
> 
> So it is with Brainpool: its twist security is poof (by pure chance) so such a mistake would be more hazardous than
> is typical. How likely that mistake would be is another matter, and I accept your point there that it'd be a rare
> decision and hopefully would be noticed in any review.
> 
> I still don't think Brainpool's fast enough to drive adoption, next to competition like 25519 and the Microsoft
> curves.

In this discussion, it is important to focus on the most essential arguments. "Twist security" is not among them, as
it only applies to very special cases and poor implementations. Montgomery and Edwards curves have other potential
problems due the non-trivial co-factor, so there is always something a sloppy implementor can screw up.

Computational performance is a valid argument, and where performance is your main criteria, your may go for special
primes and non-Weierstrass curves; but there are sufficient circumstances, where performance is not the principal
criteria. IMHO, it is wise to maintain curves with different properties to accommodate different demands.

-- 
Johannes