[curves] Unifying public key formats

[Robert Ransom]

On 1/21/15, Trevor Perrin <trevp at trevp.net> wrote:

> C) Full-format keys everywhere
> All public keys include the sign bit, so this is a true "unified
> format".  The cost of computing this sign bit is low but not
> negligible: efficient key generation will use Edwards format, so gets
> it for free.  But a Montgomery-ladder-only implementation will require
> an extra inversion, so key generation would be slowed by ~10%.

It's not an extra inversion -- remember that inversions can easily be
batched using 'Montgomery's trick'.  The extra complexity is that
implementations would need to use a point-recovery formula to recover
the Montgomery y coordinate (or the Edwards x coordinate) after the
Montgomery ladder.


Robert Ransom