[curves] Unifying public key formats

[Trevor Perrin]

On Mon, Jan 19, 2015 at 3:49 PM, Robert Ransom <rransom.8774 at gmail.com> wrote:
>
> Actually, the formulas that I posted in that message are for unpacking
> to projective coordinates in Edwards form.  You're decoding to affine,
> like Andrey Jivsov did in
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg05113.html>
> (also with help from Mike Hamburg).
>
> I'm reluctant to use the formulas that convert directly to affine
> Edwards form because those (as far as I can tell) have exceptional
> cases.

I was thinking about compatibility with Ed25519 signatures.  It's nice
to recover the Edwards y, since it's hashed as part of the signature
scheme.  Though I suppose that compatibility could be sacrificed.

Special-case handling for Montgomery x = 0 or -1 doesn't seem that
difficult or harmful.  These checks could be omitted for signatures, I
think, but for a general point format it seems worth leaving them in.


Trevor