On 01/19/2015 08:58 PM, Trevor Perrin wrote:
On Mon, Jan 19, 2015 at 6:24 PM, Michael Hamburg <[email protected]> wrote:
On their “comparison” slide did they mention that the Ed448-Goldilocks and
E-521 impls both use point compression, and therefore have a 10% penalty vs
their Ted37919 numbers? It seems a little dishonest if they didn’t.
I don't recall that being mentioned. He probably assumed it was just
timing an x-coordinate Montgomery ladder, and didn't expect your
special point format.
(Maybe you should submit just an x-coordinate ladder to SUPERCOP. I'd
like to see the numbers without decompression, this is inaccurate in
my spreadsheet too.)
Trevor
Hmm, I guess I'm overtired today.
Yeah, my code is pretty close to being just an x-coordinate ladder.
Within 1% anyway. So the penalty it pays is more like 6%. I was
thinking that if their code also did decompression, it would be 10%
slower, but if they're using compressed points then the Montgomery
ladder is a better choice.
-- Mike
_______________________________________________
Curves mailing list
[email protected]
https://moderncrypto.org/mailman/listinfo/curves
