[curves] Unifying public key formats
trevp at trevp.net
Wed Jan 21 11:52:18 PST 2015
On Mon, Jan 19, 2015 at 3:49 PM, Robert Ransom <rransom.8774 at gmail.com> wrote:
> Actually, the formulas that I posted in that message are for unpacking
> to projective coordinates in Edwards form. You're decoding to affine,
> like Andrey Jivsov did in
> (also with help from Mike Hamburg).
> I'm reluctant to use the formulas that convert directly to affine
> Edwards form because those (as far as I can tell) have exceptional
I was thinking about compatibility with Ed25519 signatures. It's nice
to recover the Edwards y, since it's hashed as part of the signature
scheme. Though I suppose that compatibility could be sacrificed.
Special-case handling for Montgomery x = 0 or -1 doesn't seem that
difficult or harmful. These checks could be omitted for signatures, I
think, but for a general point format it seems worth leaving them in.
More information about the Curves