[curves] CryptoNote and equivalent points
trevp at trevp.net
Sun May 21 19:47:22 PDT 2017
On Fri, May 19, 2017 at 7:00 PM, Mike Hamburg <mike at shiftleft.org> wrote:
> Right. This is a signature verification, probably Schnorr, so hashing to an odd number might have fixed it.
Maybe. I think I was wrong that hashing the "key image" into the
Schnorr challenge is a fix.
Multiplying the "key image" by cofactor before checking for
double-spending might work (similar to VXEdDSA producing its "VRF"
If anyone understands this algorithm in depth feel free to explain more.
> Decaf does work for Curve25519. It’s in the paper, and Henry+Isis and I have independently implemented it.
> In fact, it turns out there are multiple ways to do it for Curve25519 based on the paper, and Henry+Isis and I probably picked different ones (but we haven’t cross-tested yet, so we aren’t sure).
It would be great to see a writeup + performance analysis of the exact
Curve25519 formulas, including conversions from X25519 and Ed25519
public keys into Decaf.
People with complex protocols designed for prime-order groups will
have to weigh Decaf against just tweaking things for the cofactor, or
choosing a different curve, and the relative costs aren't that easy to
More information about the Curves