On Mon, Jan 19, 2015 at 3:49 PM, Robert Ransom <[email protected]> wrote: > > Actually, the formulas that I posted in that message are for unpacking > to projective coordinates in Edwards form. You're decoding to affine, > like Andrey Jivsov did in > <http://www.ietf.org/mail-archive/web/cfrg/current/msg05113.html> > (also with help from Mike Hamburg). > > I'm reluctant to use the formulas that convert directly to affine > Edwards form because those (as far as I can tell) have exceptional > cases.
I was thinking about compatibility with Ed25519 signatures. It's nice to recover the Edwards y, since it's hashed as part of the signature scheme. Though I suppose that compatibility could be sacrificed. Special-case handling for Montgomery x = 0 or -1 doesn't seem that difficult or harmful. These checks could be omitted for signatures, I think, but for a general point format it seems worth leaving them in. Trevor _______________________________________________ Curves mailing list [email protected] https://moderncrypto.org/mailman/listinfo/curves
