Subject: [Cfrg] New Version Notification - draft-irtf-cfrg-curves-02.txt

From: [email-masked]
Date: Tue, 24 Mar 2015 08:46:01 -0700

A new version (-02) has been submitted for draft-irtf-cfrg-curves:
http://www.ietf.org/internet-drafts/draft-irtf-cfrg-curves-02.txt

The IETF datatracker page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-curves/

Diff from previous version:
http://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-curves-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

IETF Secretariat.

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 24 Mar 2015 18:21:05 +0200

> http://www.ietf.org/internet-drafts/draft-irtf-cfrg-curves-02.txt

Some notes:
- The curve scan loop seems to only scan positive A values, not
  negative ones. Now, if p=4k+3, this is no consequence, but with p=4k+1,
  I'm not sure if there could be smaller (absolute value) negative A
  or not.
- For higher security curve, both isomorphic and isogenous curve is
  given, but for lower security level, only isomorphic one is given.
- The higher security curve isogenous curve seems to lack a basepoint.
- The higher-security curve has 56 byte input/output, not 32 byte
  (section 7, first paragraph).

-Ilari

---

From: Adam Langley <[email-masked]>
Date: Tue, 24 Mar 2015 09:34:43 -0700

>   given, but for lower security level, only isomorphic one is given.

Yes, that's an open question. The Edwards curves are given in
anticipation of future signature work. It's unclear whether signature
work on the 448-bit curve should work on the isogenous or isomorphic
curve.

> - The higher security curve isogenous curve seems to lack a basepoint.

Yep. If we keep the isogenous curve then that will need to be fixed.

>   (section 7, first paragraph).

Good point, thanks!

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org