[curves] Another try at point compression

[Michael Hamburg]

> On Dec 14, 2014, at 5:08 PM, David Leon Gil <coruus at gmail.com> wrote:
> 
> On Sun, Dec 14, 2014 at 3:36 PM, Michael Hamburg <mike at shiftleft.org> wrote:
>> The main advantage vs Montgomery x + Edwards x sign is that the encoding I’m working on eliminates the cofactor for most practical purposes.
> . . .
>> * the isogenous twisted Edwards curve with a’ = -1, d’ = d-1 effectively has complete addition formulas;
>> * the wire format supports precisely those points which can actually come out of a legitimate implementation.
> 
> These advantages strike me as rather decisive: I'd anticipate
> implementers being tempted by the performance of the twisted curve.

You can already get the performance of the twisted curve with the safety of the untwisted one, in most cases, using the 4-isogeny.  Its image on the twisted curve has complete addition.  But dealing with the factor of 4 that comes out of it is annoying, except in protocols where you wanted to do that anyway to clear the cofactor.