<div dir="ltr">You might consider using Version3 of our AMCL library<div><br></div><div><a href="https://github.com/miracl/amcl">https://github.com/miracl/amcl</a><br></div><div><br></div><div>Includes a standard API for ECDSA, which requires the inverse calculation, so should be easy to re-use that code</div><div><br></div><div>It supports multiple elliptic curves (all those mentioned here), and its simple to switch from one curve to another.</div><div><br></div><div>Also its available in Go if that is what you like (and C, Rust, Java, Javascript and Swift)</div><div><br></div><div><br></div><div>Mike Scott</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 31, 2017 at 1:27 AM, Max Skibinsky <span dir="ltr"><<a href="mailto:max@skibinsky.com" target="_blank">max@skibinsky.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><div class="gmail_default">my understanding of sphinx is that user is constructing <i>hash(password, hash(password)^device_key)</i> in such way that user never sees <i>device_key</i> and device never sees <i>hash(password). </i>That is achieved by sending <i>hash(password)^p </i>with random <i>p </i>to device/server, which responds with <i>hash(password)^(p*device_<wbr>key) </i>and then user calculates <i>hash(password)^(p*<wbr>device_key)^1/p=</i><i>hash(password)<wbr>^device_key</i><i> </i>to get final randomized password. </div><div class="gmail_default"><br></div><div class="gmail_default">Expanding on Alexey question: which curves/libs currently support calculations of inverse (1/p) so that it is possible to restore <i>hash(password)^device_<wbr>key ? </i>We run into this issue exactly while considering adding sphinx to our crypto relays (which are completely on <span style="font-size:12.800000190734863px;font-family:arial,sans-serif">curve25519)</span></div><div class="gmail_default"><br></div><div style="font-family:arial,sans-serif"><div class="m_-6928355396566393572gmail_signature"><div dir="ltr"><div><font face="arial, helvetica, sans-serif">-<div class="gmail_default" style="display:inline">max</div></font></div><div><a href="https://vault12.com/" style="font-family:arial,helvetica,sans-serif" target="_blank"><font color="#cccccc">vault12<div class="gmail_default" style="display:inline"></div></font></a><span style="font-size:13px"><br></span></div><div style="font-family:arial"><font face="arial, helvetica, sans-serif" size="2"><a href="http://skibinsky.com/" target="_blank"><font color="#cccccc"><div class="gmail_default" style="display:inline"></div>blog</font></a><span style="color:rgb(204,204,204)"> </span><b style="color:rgb(204,204,204)"><span style="border-collapse:collapse"><p style="font-weight:normal;margin:0px;display:inline"><a href="http://bit.ly/max-li" target="_blank"><font color="#cccccc">linkedin</font></a></p></span></b></font></div></div></div></div></div><div><div class="h5"><div class="gmail_extra"><div><div class="m_-6928355396566393572gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div style="text-align:left"><div style="font-size:small"><br></div></div></div></div></div><div class="gmail_quote">On Tue, May 30, 2017 at 3:37 PM, Mike Hamburg <span dir="ltr"><<a href="mailto:mike@shiftleft.org" target="_blank">mike@shiftleft.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">Is it enough to use 8*r and 8*(r^-1 mod q) for this protocol?<div><br></div><div>If not, or if you can’t prove it, you could always use my library at</div><div><br></div><div><a href="https://sourceforge.net/projects/ed448goldilocks/" target="_blank">https://sourceforge.net/projec<wbr>ts/ed448goldilocks/</a></div><div><br></div><div>It gives a prime-order quotient group of Ed448 and Curve25519, and it implements Elligator and division mod q.</div><span class="m_-6928355396566393572HOEnZb"><font color="#888888"><div><br></div></font></span><div><span class="m_-6928355396566393572HOEnZb"><font color="#888888">— Mike</font></span><div><div class="m_-6928355396566393572h5"><br><div><br><div><blockquote type="cite"><div>On May 30, 2017, at 3:31 PM, Alexey Ermishkin <<a href="mailto:scratch.net@gmail.com" target="_blank">scratch.net@gmail.com</a>> wrote:</div><br class="m_-6928355396566393572m_-2730360289834154041Apple-interchange-newline"><div><div>Thanks for pointing out at my mistakes and a very good explanation. I will<br>continue to dig deeper<br><br>______________________________<wbr>_________________<br>Curves mailing list<br><a href="mailto:Curves@moderncrypto.org" target="_blank">Curves@moderncrypto.org</a><br><a href="https://moderncrypto.org/mailman/listinfo/curves" target="_blank">https://moderncrypto.org/mailm<wbr>an/listinfo/curves</a><br></div></div></blockquote></div><br></div></div></div></div></div><br>______________________________<wbr>_________________<br> Curves mailing list<br> <a href="mailto:Curves@moderncrypto.org" target="_blank">Curves@moderncrypto.org</a><br> <a href="https://moderncrypto.org/mailman/listinfo/curves" rel="noreferrer" target="_blank">https://moderncrypto.org/mailm<wbr>an/listinfo/curves</a><br> <br></blockquote></div><br></div></div></div></div> <br>______________________________<wbr>_________________<br> Curves mailing list<br> <a href="mailto:Curves@moderncrypto.org">Curves@moderncrypto.org</a><br> <a href="https://moderncrypto.org/mailman/listinfo/curves" rel="noreferrer" target="_blank">https://moderncrypto.org/<wbr>mailman/listinfo/curves</a><br> <br></blockquote></div><br></div>