Modulo 2^198 - 17, the Edwards curve with a=-1, d=19 is secure, and the Edwards curve with a=-1, d=4871 is twist-secure. (already posted on the messaging list)
Modulo 2^213 - 3, the Edwards curve with a=-1, d=12523 is twist-secure. Modulo 2^194 - 33 (not as nice, but it's minimal-length for a 192-bit group on an Edwards curve): a=-1, d=-120 is minimal with a secure group; a=-1, d=204 is also secure; a=-1, d=229 is minimal with a secure group such that the isogenous curve a=1, d=230 has non-square d; a=-1, d=20764 is twist-secure. Again, don't use these unless your key size is seriously constrained. Robert Ransom _______________________________________________ Curves mailing list [email protected] https://moderncrypto.org/mailman/listinfo/curves
