[curves] Ed25519 "clamping" and its effect on hierarchical key derivation

Tony Arcieri bascule at gmail.com
Wed Mar 29 14:01:24 PDT 2017

On Wed, Mar 29, 2017 at 12:34 PM, Ron Garret <ron at flownet.com> wrote:

> What would be the benefit?

The main benefit is that the D-H use case deals only with Montgomery-x
coordinates, and all scalar multiplications can be performed using the
Montgomery ladder.

> It seems to me that it doesn’t really matter much one way or the other,
> but if you’re going to convert one to the other then it seems to make more
> sense to derive the DH key from the DSA key because going the other way you
> lose the sign of the Y coordinate.

Trevor wrote a great post highlighting the respective tradeoffs here:


Tony Arcieri
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/curves/attachments/20170329/aa5e2a75/attachment.html>

More information about the Curves mailing list