Subject: Re: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

From: Dan Brown <[email-masked]>
Date: Thu, 5 Mar 2015 23:56:44 +0000

Montgomery form is acceptable to me, but I'd prefer ‎short Weierstrass form for outputs, so shifting u to x by A/3 in the direction needed. Edwards is acceptable to me too, but less so, for the small reason it is newer.

Best regards, 

-- Dan
  Original Message  
From: Alexey Melnikov
Sent: Thursday, March 5, 2015 6:31 PM
To: [email-masked]
Subject: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

CFRG chairs are starting discussion of the next topic:

Q4: draft-irtf-cfrg-curves-01 currently contains curves in both 
Montgomery form and Edwards form. The scalar multiplication routine is 
specified using Montgomery form (and is specific to Curve25519, which 
will need to be changed given our decision to include a higher security 
level curve). Its input is a scalar and the u-coordinate of a point on a 
Montgomery-form curve; its output is the u-coordinate of a point on a 
Montgomery-form curve. The DH function builds on this routine. Do we 
want to stay with specifying the inputs and outputs in Montgomery form 
for these routines? Or do we want to switch to an alternative curve form 
and coordinate system for defining the routines? If so, which form and 
coordinate system?

[Chairs are aware that it is possible to switch back and forward between 
different curve forms and coordinate systems, with associated costs, no 
matter which form is specified for the inputs and outputs of the 
routines. But we now have to decide *which* form we want to use for 
inputs and outputs, so as to ensure interoperability between Alice and 
Bob. Chairs did not want to implicitly force the choice of Montgomery 
form/coordinates without polling the group first.]

Once this issues is settled, we will be discussing (in no particular 
order. Chairs reserve the right to add additional questions) wire 
format, byte order and signature schemes. Please don't discuss any of 
these future topics at this time.

_______________________________________________
Cfrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/cfrg

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 5 Mar 2015 21:19:21 -0500

On Thu, Mar 5, 2015 at 6:56 PM, Dan Brown <[email-masked]> wrote:

> Montgomery form is acceptable to me, but I'd prefer ‎short Weierstrass
> form for outputs, so shifting u to x by A/3 in the direction needed.
> Edwards is acceptable to me too, but less so, for the small reason it is
> newer.
>

I would prefer Edwards for the same reason.

My principal concern is patent barnacles that have accumulated. So I like
really old stuff and stuff that is new enough that there are fewer
barnacles.

I know that it is possible to convert from one form to another but the
patent claims don't automatically translate (even under the doctrine of
equivalences).

Another thing in favor of the Edwards curve is that it is a lot easier to
explain than drawing lines through squiggles and reflecting them.

Unless there is a good reason to do otherwise, like a performance gain of
more than 30%, I would prefer backwards compatibility with Curve25519 at
the WF128 level. But that argument would not hold for WF256.