(Changing title) On Thu, Oct 20, 2016 at 10:52 PM, Ron Garret <[email protected]> wrote: > You derive DSA keys from DH keys using the bilateral equivalence relation and > setting the sign bit to zero. Why not instead go the other way and derive DH > keys from DSA keys? That way you get to keep the sign bit. One bit is not a > big deal, but was there a reason for going DH->DSA instead of the other way?
Sure, it allows the Montgomery ladder for DH, see discussion at beginning of 2.3. Trevor _______________________________________________ Curves mailing list [email protected] https://moderncrypto.org/mailman/listinfo/curves
