Subject: [Cfrg] Last Call on draft-irtf-cfrg-curves-05.txt

From: Alexey Melnikov <[email-masked]>
Date: Mon, 24 Aug 2015 13:14:05 +0100

Dear CFRG participants,

This message is starting CFRG Last Call on draft-irtf-cfrg-curves-05.txt 
(Elliptic Curves for Security). The LC will end on September 14th (3 
weeks to account for holidays). Please send your comments, statements of 
support ("I read it and it is ready to publish"), etc. to the mailing 
list or directly to CFRG chairs.

Note that CFRG is still working on EC signatures and the CFRG selection 
would be documented in another draft.

Thank you,
Kenny and Alexey

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 24 Aug 2015 15:03:24 +0000

Ship it.

--  
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 29 Aug 2015 12:42:48 +0300

On Mon, Aug 24, 2015 at 01:14:05PM +0100, Alexey Melnikov wrote:
> (Elliptic Curves for Security). The LC will end on September 14th (3 weeks
> to account for holidays). Please send your comments, statements of support
> ("I read it and it is ready to publish"), etc. to the mailing list or
> directly to CFRG chairs.

Comments:
- I can't get the X448 DH shared secret test vector to verify (every
  other test vector in the doc I can find verifies, including the 1M
  round tests)[1]...
- I think some point format ought to be specified for Edwards[2].

[1] I did calculation of the value using BC and GP, the result
agrees with my program...

Oh, looks it is the known-bugged KAT that hasn't gotten fixed:
http://www.ietf.org/mail-archive/web/cfrg/current/msg06770.html

[2] Proposal:

Edwards-255199: 32 octets, little-endian representation of
(y%p)+(x%p%2)*2^255.

Edwards-448: 57 octets, little-endian representation of
(y%p)+(x%p%2)*2^455.

That is, little-endian presentation of y%p with the least number of
octets plus x%p%2 as the MSB of the last octet (adding new octet if
presenting y%p takes integral number of octets).

I think placing the x-bit in MSB is a bit simpler than placing it
as next available bit if multiple curves are supported.

The reason for using x%p%2 is that it is the simplest to compute
function F: Z_p -> {0,1} such that F(x)!=F(-x) for any x not additive
identity.

AFAIK, the extended EdDSA paper specifies exactly this point format.

-Ilari

---

From: Adam Langley <[email-masked]>
Date: Sat, 29 Aug 2015 08:07:10 -0700

> - I think some point format ought to be specified for Edwards[2].

We'll certainly need it either in this document or the next. But it's
the chairs call, not mine.

> http://www.ietf.org/mail-archive/web/cfrg/current/msg06770.html

Thank you for finding that! I had missed that email but it's now
fixed. (And thanks for testing the other vectors.)

> AFAIK, the extended EdDSA paper specifies exactly this point format.

For what it's worth, I also agree that this is the obvious choice for
Edwards point format.

Cheers

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org