<div dir="ltr"><font face="courier new, monospace">I just quickly played around with this too. Looking at 96 potential Crandalls (2^n - c, 80 <= n <= 1024, c < 32, no prime for smaller c), looking at those that aren't dominated for size, 32-bit length, 28-bit limbs or 58-bit limbs gets 60 potentials. Ignoring the 28-bit kills 9 more.</font><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">prime mod 4 28 32 58</font></div><div><div><font face="courier new, monospace">2^95 - 15 1 4 3 2</font></div><div><font face="courier new, monospace">2^96 - 17 3 4 3 2</font></div><div><font face="courier new, monospace">2^109 - 31 1 4 4 2</font></div><div><font face="courier new, monospace">2^110 - 21 3 4 4 2</font></div><div><font face="courier new, monospace">2^116 - 3 1 5 4 2</font></div><div><font face="courier new, monospace">2^122 - 3 1 5 4 3</font></div><div><font face="courier new, monospace">2^127 - 1 3 5 4 3</font></div><div><font face="courier new, monospace">2^137 - 13 3 5 5 3</font></div><div><font face="courier new, monospace">2^140 - 27 1 5 5 3</font></div><div><font face="courier new, monospace">2^152 - 17 3 6 5 3</font></div><div><font face="courier new, monospace">2^158 - 15 1 6 5 3</font></div><div><font face="courier new, monospace">2^166 - 5 3 6 6 3</font></div><div><font face="courier new, monospace">2^174 - 3 1 7 6 3</font></div><div><font face="courier new, monospace">2^189 - 25 3 7 6 4</font></div><div><font face="courier new, monospace">2^191 - 19 1 7 6 4</font></div><div><font face="courier new, monospace">2^196 - 15 1 7 7 4</font></div><div><font face="courier new, monospace">2^206 - 5 3 8 7 4</font></div><div><font face="courier new, monospace">2^221 - 3 1 8 7 4</font></div><div><font face="courier new, monospace">2^226 - 5 3 9 8 4</font></div><div><font face="courier new, monospace">2^230 - 27 1 9 8 4</font></div><div><font face="courier new, monospace">2^235 - 15 1 9 8 5</font></div><div><font face="courier new, monospace">2^251 - 9 3 9 8 5</font></div><div><font face="courier new, monospace">2^255 - 19 1 10 8 5</font></div><div><font face="courier new, monospace">2^266 - 3 1 10 9 5</font></div><div><font face="courier new, monospace">2^285 - 9 3 11 9 5</font></div><div><font face="courier new, monospace">2^291 - 19 1 11 10 6</font></div><div><font face="courier new, monospace">2^321 - 9 3 12 11 6</font></div><div><font face="courier new, monospace">2^336 - 3 1 12 11 6</font></div><div><font face="courier new, monospace">2^338 - 15 1 13 11 6</font></div><div><font face="courier new, monospace">2^369 - 25 3 14 12 7</font></div><div><font face="courier new, monospace">2^383 - 31 1 14 12 7</font></div><div><font face="courier new, monospace">2^389 - 21 3 14 13 7</font></div><div><font face="courier new, monospace">2^401 - 31 1 15 13 7</font></div><div><font face="courier new, monospace">2^414 - 17 3 15 13 8</font></div><div><font face="courier new, monospace">2^444 - 17 3 16 14 8</font></div><div><font face="courier new, monospace">2^452 - 3 1 17 15 8</font></div><div><font face="courier new, monospace">2^468 - 17 3 17 15 9</font></div><div><font face="courier new, monospace">2^489 - 21 3 18 16 9</font></div><div><font face="courier new, monospace">2^495 - 31 1 18 16 9</font></div><div><font face="courier new, monospace">2^521 - 1 3 19 17 9</font></div><div><font face="courier new, monospace">2^529 - 31 1 19 17 10</font></div><div><font face="courier new, monospace">2^537 - 9 3 20 17 10</font></div><div><font face="courier new, monospace">2^546 - 11 1 20 18 10</font></div><div><font face="courier new, monospace">2^550 - 5 3 20 18 10</font></div><div><font face="courier new, monospace">2^563 - 9 3 21 18 10</font></div><div><font face="courier new, monospace">2^583 - 27 1 21 19 11</font></div><div><font face="courier new, monospace">2^607 - 1 3 22 19 11</font></div><div><font face="courier new, monospace">2^610 - 27 1 22 20 11</font></div><div><font face="courier new, monospace">2^620 - 15 1 23 20 11</font></div><div><font face="courier new, monospace">2^664 - 17 3 24 21 12</font></div><div><font face="courier new, monospace">2^694 - 3 1 25 22 12</font></div><div><font face="courier new, monospace">2^699 - 9 3 25 22 13</font></div><div><font face="courier new, monospace">2^715 - 7 1 26 23 13</font></div><div><font face="courier new, monospace">2^717 - 25 3 26 23 13</font></div><div><font face="courier new, monospace">2^729 - 9 3 27 23 13</font></div><div><font face="courier new, monospace">2^810 - 5 3 29 26 14</font></div><div><font face="courier new, monospace">2^848 - 17 3 31 27 15</font></div><div><font face="courier new, monospace">2^850 - 3 1 31 27 15</font></div><div><font face="courier new, monospace">2^869 - 21 3 32 28 15</font></div><div><font face="courier new, monospace">2^923 - 31 1 33 29 16</font></div></div><div><font face="courier new, monospace"><br></font></div><div class="gmail_extra"><font face="courier new, monospace"><br></font><div class="gmail_quote"><font face="courier new, monospace">On 27 October 2014 17:17, Michael Hamburg <span dir="ltr"><<a href="mailto:mike@shiftleft.org" target="_blank">mike@shiftleft.org</a>></span> wrote:<br></font><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><span class=""><font face="courier new, monospace"><br><div><blockquote type="cite"><div>On Oct 26, 2014, at 11:57 PM, Mike Hamburg <<a href="mailto:mike@shiftleft.org" target="_blank">mike@shiftleft.org</a>> wrote:</div></blockquote><br><blockquote type="cite"><div><span style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;float:none;display:inline!important">Right. In my try, I had calculated it by multiplication not requiring internal carry propagation, which depends on c as well as nail length. This can be computed by expanding the prime into polynomial P in the radix, and comparing the largest coefficient of ((x^limbs - 1) / (x-1))^2 mod P to 2^(2*wordsize - 2*radix - extra). Here extra is some small amount (0.1) to account for not having reduced perfectly the first time; + 1 if the polynomial is signed;</span></div></blockquote><br><blockquote type="cite"><div></div></blockquote></div></font></span><div><font face="courier new, monospace">+1 if the polynomial is signed isn’t quite right actually. It should be something more like, always treat the non-leading coefficients of the polynomial as negative, so that when computing the reduction they always add to each other rather than canceling.</font></div><span class="HOEnZb"><font color="#888888" face="courier new, monospace"><div><br></div><div>— Mike</div></font></span></div><font face="courier new, monospace"><br>_______________________________________________<br>
Curves mailing list<br>
<a href="mailto:Curves@moderncrypto.org">Curves@moderncrypto.org</a><br>
<a href="https://moderncrypto.org/mailman/listinfo/curves" target="_blank">https://moderncrypto.org/mailman/listinfo/curves</a><br>
<br></font></blockquote></div><br></div></div>