[curves] Ed25519 "clamping" and its effect on hierarchical key derivation

[Tony Arcieri]

On Wed, Mar 29, 2017 at 12:34 PM, Ron Garret <ron at flownet.com> wrote:

> What would be the benefit?
>

The main benefit is that the D-H use case deals only with Montgomery-x
coordinates, and all scalar multiplications can be performed using the
Montgomery ladder.


> It seems to me that it doesn’t really matter much one way or the other,
> but if you’re going to convert one to the other then it seems to make more
> sense to derive the DH key from the DSA key because going the other way you
> lose the sign of the Y coordinate.
>

Trevor wrote a great post highlighting the respective tradeoffs here:

https://moderncrypto.org/mail-archive/curves/2015/000376.html

-- 
Tony Arcieri
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/curves/attachments/20170329/aa5e2a75/attachment.html>