On 1/21/15, Trevor Perrin <[email protected]> wrote: > C) Full-format keys everywhere > All public keys include the sign bit, so this is a true "unified > format". The cost of computing this sign bit is low but not > negligible: efficient key generation will use Edwards format, so gets > it for free. But a Montgomery-ladder-only implementation will require > an extra inversion, so key generation would be slowed by ~10%.
It's not an extra inversion -- remember that inversions can easily be batched using 'Montgomery's trick'. The extra complexity is that implementations would need to use a point-recovery formula to recover the Montgomery y coordinate (or the Edwards x coordinate) after the Montgomery ladder. Robert Ransom _______________________________________________ Curves mailing list [email protected] https://moderncrypto.org/mailman/listinfo/curves
