Re: [TLS] On Curve25519 and other possibilities (e.g. ietf256p, ietf384p, ietf521p,

[Johannes Merkle <[e-mail]>]

Watson Ladd wrote on 04.07.2014 17:15:

> Twist security matters for Joyce-Briers ladders only, as far as I know
> on Weierstrass curves. Other formulas use the y coordinates.

Exactly, and as DJB points out, the Joyce-Briers ladder "requires 19 field operations per bit, many more field
operations than standard addition chains for short Weierstrass curves" [1]. Therefore, "twist security" is irrelevant
for Weierstrass curves unless someone decides to implement the Joyce-Briers ladder despite of its inferior performance.

I was objecting to Alyssa's statement "in the case of Brainpool, the 256-bit curve has extremely unfortunate lack of
twist security", which, IMHO, grossly exaggerates the importance of twist security. Lack of "twist security" is an issue
for Weierstrass curves only in circumstances where implementors choose an unusual technique and screw up one essential
part.

[1] http://safecurves.cr.yp.to/ladder.html
-- 
Johannes