[curves] Unifying public key formats

Trevor Perrin trevp at trevp.net
Wed Jan 21 11:52:18 PST 2015

On Mon, Jan 19, 2015 at 3:49 PM, Robert Ransom <rransom.8774 at gmail.com> wrote:
> Actually, the formulas that I posted in that message are for unpacking
> to projective coordinates in Edwards form.  You're decoding to affine,
> like Andrey Jivsov did in
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg05113.html>
> (also with help from Mike Hamburg).
> I'm reluctant to use the formulas that convert directly to affine
> Edwards form because those (as far as I can tell) have exceptional
> cases.

I was thinking about compatibility with Ed25519 signatures.  It's nice
to recover the Edwards y, since it's hashed as part of the signature
scheme.  Though I suppose that compatibility could be sacrificed.

Special-case handling for Montgomery x = 0 or -1 doesn't seem that
difficult or harmful.  These checks could be omitted for signatures, I
think, but for a general point format it seems worth leaving them in.


More information about the Curves mailing list