<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">One reason might be: because you like almost everything else about Curve25519 other than the specially chosen sparse prime, aren’t especially performance sensitive, and your application is cryptographically very conservative, so you’re willing to trade off performance for totally unstructured and “provably” random parameters.</div> <div><br></div><div>Alyssa Rowan suggested on HN yesterday that a plausible (but weird) scenario for that would be that you’re reusing RSA hardware for your ECC stuff, want all the security benefits of Curve25519, but 2^255-19 might be leak-prone on that hardware.</div><div><br></div><div>(I am parroting some of this from a brief conversation with one of the paper authors, which set me off on a reading jag yesterday, and while I don’t find the argument especially persuasive, it at least makes sense to me now.)</div><br> <div id="bloop_sign_1456338763386324992" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px">-- <br>Thomas Ptacek<br>312-231-7805</div></div> <br><p class="airmail_on">On February 24, 2016 at 12:31:08 PM, Salz, Rich (<a href="mailto:rsalz@akamai.com">rsalz@akamai.com</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<br>> 2. Their paper doesn’t claim anything is wrong with 25519. They’re just proposing a random Edwards curve alternative to 25519
<br>
<br>Which brings me back to the million-dollar question: why do I want this?
<br>
<br>
<br></div></div></span></blockquote></body></html>