[curves] Fwd: Crash Course on ECC poster

[Tanja Lange]

Dear Tony,
>     I've seen 'clock arithmetic' used for computing mod p but I think
>     Dan Bernstein and I were introducing 'clock crypto' for real clocks.
>     Of course you're  'clock crypto' any way you want but I find it to
>     be confusing with our way of presenting elliptic curves via clocks,
>     where we use proper arithmetic on the clock (=circle). For our
>     presentation the comment about 'distorted clocks' makes sense, I
>     don't understand what it means if you take the clock to be just the
>     integers mod some prime.
> 
> 
> I got similar feedback from Tom Ptacek so... duly noted.
> 
> I was trying to make a visual allusion to hours being points on a circle,
> without really describing that in prose (or arithmetic). Hence the big red
> points on the circle. And really I was trying to use that all as a lead in to
> the Dali analogy.
> 
> One thing that I think might help that is completely abandoning the clock face
> metaphor and just using a simple circle with the hours. I might have the space
> to attempt to describe the hours as points on a unit circle and show those on
> each of the respective "clocks".
> 
> Here's a new version that does away with the clock face metaphor and replaces
> it with a simple circle, and hopefully addresses your other nits:
>
Sorry for assuming that clock crypto was clear. See e.g. 
	http://ecchacks.cr.yp.to/
and the corresponding slides at
	http://cr.yp.to/talks/2014.12.27/slides-dan+tanja-20141227-a4.pdf

Here is what I would do:
Take the usual clock, show how to add points = adding pizza slices. It's
really addition, it's very visual. 
Then you can take a point, 1 is totlly fine because you're doing addition,
but ny other is also fine. And you can do scalar multiplication.
Bonus: no need to change notation from addition.

And of course I would put Weierstrass curves somewhere in the comments
section (or explain an addition law that works for all points, but 
that's a nuisance).

More nits:
* Using scalars/exponents larger than the group order doesn't
make sense; also choosing large exponents just makes it hard for the
reader to check the result.

* At the moment your text still speaks about 'addition of hours'

* You mention 'complexity of the asocitated field arithmetic' as an
argument against Weierstrass curves -- but that's independent of 
the curve shape. 
If you stick with your current explanation you can actually illustrate
the 'error prone nature' by pointing out that the method on the left 
does not actually work if A=B.

All the best
	Tanja