<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Thank you for sharing this Mike. looks like a great lib, quite a delight to find both Swift and Rust implementation.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_extra"><div><font face="arial, helvetica, sans-serif">-<div class="gmail_default" style="display:inline">max</div></font></div><div><a href="https://vault12.com/" target="_blank" style="font-family:arial,helvetica,sans-serif"><font color="#cccccc">vault12<div class="gmail_default" style="display:inline"></div></font></a><span style="font-size:13px"><br></span></div><div style="font-family:arial"><font face="arial, helvetica, sans-serif" size="2"><a href="http://skibinsky.com/" target="_blank"><font color="#cccccc"><div class="gmail_default" style="display:inline"></div>blog</font></a><span style="color:rgb(204,204,204)"> </span><b style="color:rgb(204,204,204)"><span style="border-collapse:collapse"><p style="font-weight:normal;margin:0px;display:inline"><a href="http://bit.ly/max-li" target="_blank"><font color="#cccccc">linkedin</font></a></p></span></b></font></div> <br><div class="gmail_quote">On Wed, May 31, 2017 at 1:21 AM, Michael Scott <span dir="ltr"><<a href="mailto:mike.scott@miracl.com" target="_blank">mike.scott@miracl.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">You might consider using Version3 of our AMCL library<div><br></div><div><a href="https://github.com/miracl/amcl" target="_blank">https://github.com/miracl/amcl</a><br></div><div><br></div><div>Includes a standard API for ECDSA, which requires the inverse calculation, so should be easy to re-use that code</div><div><br></div><div>It supports multiple elliptic curves (all those mentioned here), and its simple to switch from one curve to another.</div><div><br></div><div>Also its available in Go if that is what you like (and C, Rust, Java, Javascript and Swift)</div><div><br></div><div><br></div><div>Mike Scott</div><div><br></div><div><br></div></div><div class="gmail-HOEnZb"><div class="gmail-h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 31, 2017 at 1:27 AM, Max Skibinsky <span dir="ltr"><<a href="mailto:max@skibinsky.com" target="_blank">max@skibinsky.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-family:arial,helvetica,sans-serif;font-size:small"><div>my understanding of sphinx is that user is constructing <i>hash(password, hash(password)^device_key)</i> in such way that user never sees <i>device_key</i> and device never sees <i>hash(password). </i>That is achieved by sending <i>hash(password)^p </i>with random <i>p </i>to device/server, which responds with <i>hash(password)^(p*device_<wbr>key) </i>and then user calculates <i>hash(password)^(p*d<wbr>evice_key)^1/p=</i><i>hash(password)^<wbr>device_key</i><i> </i>to get final randomized password. </div><div><br></div><div>Expanding on Alexey question: which curves/libs currently support calculations of inverse (1/p) so that it is possible to restore <i>hash(password)^device_<wbr>key ? </i>We run into this issue exactly while considering adding sphinx to our crypto relays (which are completely on <span style="font-size:12.800000190734863px;font-family:arial,sans-serif">curve25519)</span></div><div><br></div><div style="font-family:arial,sans-serif"><div class="gmail-m_-7132639404704311325m_-6928355396566393572gmail_signature"><div dir="ltr"><div><font face="arial, helvetica, sans-serif">-<div style="display:inline">max</div></font></div><div><a href="https://vault12.com/" style="font-family:arial,helvetica,sans-serif" target="_blank"><font color="#cccccc">vault12<div style="display:inline"></div></font></a><span style="font-size:13px"><br></span></div><div style="font-family:arial"><font face="arial, helvetica, sans-serif" size="2"><a href="http://skibinsky.com/" target="_blank"><font color="#cccccc"><div style="display:inline"></div>blog</font></a><span style="color:rgb(204,204,204)"> </span><b style="color:rgb(204,204,204)"><span style="border-collapse:collapse"><p style="font-weight:normal;margin:0px;display:inline"><a href="http://bit.ly/max-li" target="_blank"><font color="#cccccc">linkedin</font></a></p></span></b></font></div></div></div></div></div><div><div class="gmail-m_-7132639404704311325h5"><div class="gmail_extra"><div><div class="gmail-m_-7132639404704311325m_-6928355396566393572gmail_signature"><div dir="ltr"><div style="text-align:left"><div style="font-size:small"><br></div></div></div></div></div><div class="gmail_quote">On Tue, May 30, 2017 at 3:37 PM, Mike Hamburg <span dir="ltr"><<a href="mailto:mike@shiftleft.org" target="_blank">mike@shiftleft.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word">Is it enough to use 8*r and 8*(r^-1 mod q) for this protocol?<div><br></div><div>If not, or if you can’t prove it, you could always use my library at</div><div><br></div><div><a href="https://sourceforge.net/projects/ed448goldilocks/" target="_blank">https://sourceforge.net/projec<wbr>ts/ed448goldilocks/</a></div><div><br></div><div>It gives a prime-order quotient group of Ed448 and Curve25519, and it implements Elligator and division mod q.</div><span class="gmail-m_-7132639404704311325m_-6928355396566393572HOEnZb"><font color="#888888"><div><br></div></font></span><div><span class="gmail-m_-7132639404704311325m_-6928355396566393572HOEnZb"><font color="#888888">— Mike</font></span><div><div class="gmail-m_-7132639404704311325m_-6928355396566393572h5"><br><div><br><div><blockquote type="cite"><div>On May 30, 2017, at 3:31 PM, Alexey Ermishkin <<a href="mailto:scratch.net@gmail.com" target="_blank">scratch.net@gmail.com</a>> wrote:</div><br class="gmail-m_-7132639404704311325m_-6928355396566393572m_-2730360289834154041Apple-interchange-newline"><div><div>Thanks for pointing out at my mistakes and a very good explanation. I will<br>continue to dig deeper<br><br>______________________________<wbr>_________________<br>Curves mailing list<br><a href="mailto:Curves@moderncrypto.org" target="_blank">Curves@moderncrypto.org</a><br><a href="https://moderncrypto.org/mailman/listinfo/curves" target="_blank">https://moderncrypto.org/mailm<wbr>an/listinfo/curves</a><br></div></div></blockquote></div><br></div></div></div></div></div><br>______________________________<wbr>_________________<br> Curves mailing list<br> <a href="mailto:Curves@moderncrypto.org" target="_blank">Curves@moderncrypto.org</a><br> <a href="https://moderncrypto.org/mailman/listinfo/curves" rel="noreferrer" target="_blank">https://moderncrypto.org/mailm<wbr>an/listinfo/curves</a><br> <br></blockquote></div><br></div></div></div></div> <br>______________________________<wbr>_________________<br> Curves mailing list<br> <a href="mailto:Curves@moderncrypto.org" target="_blank">Curves@moderncrypto.org</a><br> <a href="https://moderncrypto.org/mailman/listinfo/curves" rel="noreferrer" target="_blank">https://moderncrypto.org/mailm<wbr>an/listinfo/curves</a><br> <br></blockquote></div><br></div> </div></div><br>______________________________<wbr>_________________<br> Curves mailing list<br> <a href="mailto:Curves@moderncrypto.org">Curves@moderncrypto.org</a><br> <a href="https://moderncrypto.org/mailman/listinfo/curves" rel="noreferrer" target="_blank">https://moderncrypto.org/<wbr>mailman/listinfo/curves</a><br> <br></blockquote></div><br></div></div>