Difference on montgomery curve equation between EFD and RFC7748












3












$begingroup$


There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links



https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html





      A = X2+Z2

      AA = A^2

      B = X2-Z2

      BB = B^2

      E = AA-BB

      C = X3+Z3

      D = X3-Z3

      DA = D*A

      CB = C*B

      X5 = (DA+CB)^2

      Z5 = X1*(DA-CB)^2

      X4 = AA*BB

      Z4 = E*(BB+a24*E)


https://tools.ietf.org/html/rfc7748





       A = x_2 + z_2

       AA = A^2

       B = x_2 - z_2

       BB = B^2

       E = AA - BB

       C = x_3 + z_3

       D = x_3 - z_3

       DA = D * A

       CB = C * B

       x_3 = (DA + CB)^2

       z_3 = x_1 * (DA - CB)^2

       x_2 = AA * BB

       z_2 = E * (AA + a24 * E)


This AA / BB change on the last line does affect the result of a point multiplication with same input parameters.



Is there a reason for that difference ?






elliptic-curves x25519 rfc7748 x448







share|improve this question











$endgroup$












  • $begingroup$
    It looks to be a typo in RFC. When BB is used (as in EFD and original P.L. Montgomery paper), the test vectors can be reproduced. Submitted a review comment to RFC. Errare humanum est. How many existing implementations will fail to inter-operate ?
    $endgroup$
    – Pierre
    4 hours ago


















3












$begingroup$


There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links



https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html





      A = X2+Z2

      AA = A^2

      B = X2-Z2

      BB = B^2

      E = AA-BB

      C = X3+Z3

      D = X3-Z3

      DA = D*A

      CB = C*B

      X5 = (DA+CB)^2

      Z5 = X1*(DA-CB)^2

      X4 = AA*BB

      Z4 = E*(BB+a24*E)


https://tools.ietf.org/html/rfc7748





       A = x_2 + z_2

       AA = A^2

       B = x_2 - z_2

       BB = B^2

       E = AA - BB

       C = x_3 + z_3

       D = x_3 - z_3

       DA = D * A

       CB = C * B

       x_3 = (DA + CB)^2

       z_3 = x_1 * (DA - CB)^2

       x_2 = AA * BB

       z_2 = E * (AA + a24 * E)


This AA / BB change on the last line does affect the result of a point multiplication with same input parameters.



Is there a reason for that difference ?






elliptic-curves x25519 rfc7748 x448







share|improve this question











$endgroup$












  • $begingroup$
    It looks to be a typo in RFC. When BB is used (as in EFD and original P.L. Montgomery paper), the test vectors can be reproduced. Submitted a review comment to RFC. Errare humanum est. How many existing implementations will fail to inter-operate ?
    $endgroup$
    – Pierre
    4 hours ago
















3












3








3





$begingroup$


There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links



https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html





      A = X2+Z2

      AA = A^2

      B = X2-Z2

      BB = B^2

      E = AA-BB

      C = X3+Z3

      D = X3-Z3

      DA = D*A

      CB = C*B

      X5 = (DA+CB)^2

      Z5 = X1*(DA-CB)^2

      X4 = AA*BB

      Z4 = E*(BB+a24*E)


https://tools.ietf.org/html/rfc7748





       A = x_2 + z_2

       AA = A^2

       B = x_2 - z_2

       BB = B^2

       E = AA - BB

       C = x_3 + z_3

       D = x_3 - z_3

       DA = D * A

       CB = C * B

       x_3 = (DA + CB)^2

       z_3 = x_1 * (DA - CB)^2

       x_2 = AA * BB

       z_2 = E * (AA + a24 * E)


This AA / BB change on the last line does affect the result of a point multiplication with same input parameters.



Is there a reason for that difference ?






elliptic-curves x25519 rfc7748 x448







share|improve this question











$endgroup$




There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links



https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html





      A = X2+Z2

      AA = A^2

      B = X2-Z2

      BB = B^2

      E = AA-BB

      C = X3+Z3

      D = X3-Z3

      DA = D*A

      CB = C*B

      X5 = (DA+CB)^2

      Z5 = X1*(DA-CB)^2

      X4 = AA*BB

      Z4 = E*(BB+a24*E)


https://tools.ietf.org/html/rfc7748





       A = x_2 + z_2

       AA = A^2

       B = x_2 - z_2

       BB = B^2

       E = AA - BB

       C = x_3 + z_3

       D = x_3 - z_3

       DA = D * A

       CB = C * B

       x_3 = (DA + CB)^2

       z_3 = x_1 * (DA - CB)^2

       x_2 = AA * BB

       z_2 = E * (AA + a24 * E)


This AA / BB change on the last line does affect the result of a point multiplication with same input parameters.



Is there a reason for that difference ?






elliptic-curves x25519 rfc7748 x448




elliptic-curves x25519 rfc7748 x448






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited 5 hours ago









puzzlepalace

2,8701133




2,8701133










asked 6 hours ago









PierrePierre

36718




36718












  • $begingroup$
    It looks to be a typo in RFC. When BB is used (as in EFD and original P.L. Montgomery paper), the test vectors can be reproduced. Submitted a review comment to RFC. Errare humanum est. How many existing implementations will fail to inter-operate ?
    $endgroup$
    – Pierre
    4 hours ago




















  • $begingroup$
    It looks to be a typo in RFC. When BB is used (as in EFD and original P.L. Montgomery paper), the test vectors can be reproduced. Submitted a review comment to RFC. Errare humanum est. How many existing implementations will fail to inter-operate ?
    $endgroup$
    – Pierre
    4 hours ago


















$begingroup$
It looks to be a typo in RFC. When BB is used (as in EFD and original P.L. Montgomery paper), the test vectors can be reproduced. Submitted a review comment to RFC. Errare humanum est. How many existing implementations will fail to inter-operate ?
$endgroup$
– Pierre
4 hours ago






$begingroup$
It looks to be a typo in RFC. When BB is used (as in EFD and original P.L. Montgomery paper), the test vectors can be reproduced. Submitted a review comment to RFC. Errare humanum est. How many existing implementations will fail to inter-operate ?
$endgroup$
– Pierre
4 hours ago












2 Answers
2






active

oldest

votes


















4












$begingroup$

This is not a bug: it arises from different choice of sign in the definition of a24 := (a ± 2)/4; the RFC uses - while the EFD uses +.



RFC, following the Curve25519 paper:




The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and (156326 - 2) / 4 = 39081 for curve448/X448.




EFD, following Montgomery's paper (paywall-free):




Assumptions: 4*a24=a+2.




This apparent discrepancy was raised by Paul Lambert on the CFRG mailing list during discussion on the draft. It doesn't really matter which one you choose, as long as you're consistent about it!






share|improve this answer









$endgroup$













  • $begingroup$
    Thanks for the explanation. I didn't spot the little difference on a24 definition between the RFC and the EFD.
    $endgroup$
    – Pierre
    1 hour ago



















4












$begingroup$

This is not a typo; it is a difference in how the Montgomery doubling formula was derived between the original paper and the curve25519 paper. Both are correct.



To double a point on a Montgomery curve
$$
y^2 = x^3 + Ax^2 + x,,
$$
one has the identity relating the doubled point $(x_3, cdot)$ and the source point $(x_1, cdot)$:
$$
x_3 4x_1(x_1^2 + Ax_1 + 1) = (x_1^2 - 1)^2,.
$$
The doubled point $x_3$ can thus be computed as the fraction
$$
frac{(x_1^2 - 1)^2}{4x_1(x_1^2 + Ax_1 + 1)},.
$$
But to minimize the operation number, and obtain several common subexpressions, we can write $(x_1^2 - 1)^2$ as $(x_1+1)^2(x_1-1)^2$, $4x_1$ as $(x_1 + 1)^2 - (x_1 - 1)^2$, and $x_1^2 + Ax_1 + 1$ as either $(x_1-1)^2 + ((A+2)/4)4x_1$ or $(x_1+1)^2 + ((A-2)/4)4x_1$. It is this latter somewhat arbitrary choice that results in there being two almost identical Montgomery doubling formulas.






share|improve this answer









$endgroup$













    Your Answer





    StackExchange.ifUsing("editor", function () {
    return StackExchange.using("mathjaxEditing", function () {
    StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
    StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
    });
    });
    }, "mathjax-editing");

    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "281"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    noCode: true, onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67942%2fdifference-on-montgomery-curve-equation-between-efd-and-rfc7748%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    2 Answers
    2






    active

    oldest

    votes








    2 Answers
    2






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    4












    $begingroup$

    This is not a bug: it arises from different choice of sign in the definition of a24 := (a ± 2)/4; the RFC uses - while the EFD uses +.



    RFC, following the Curve25519 paper:




    The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and (156326 - 2) / 4 = 39081 for curve448/X448.




    EFD, following Montgomery's paper (paywall-free):




    Assumptions: 4*a24=a+2.




    This apparent discrepancy was raised by Paul Lambert on the CFRG mailing list during discussion on the draft. It doesn't really matter which one you choose, as long as you're consistent about it!






    share|improve this answer









    $endgroup$













    • $begingroup$
      Thanks for the explanation. I didn't spot the little difference on a24 definition between the RFC and the EFD.
      $endgroup$
      – Pierre
      1 hour ago
















    4












    $begingroup$

    This is not a bug: it arises from different choice of sign in the definition of a24 := (a ± 2)/4; the RFC uses - while the EFD uses +.



    RFC, following the Curve25519 paper:




    The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and (156326 - 2) / 4 = 39081 for curve448/X448.




    EFD, following Montgomery's paper (paywall-free):




    Assumptions: 4*a24=a+2.




    This apparent discrepancy was raised by Paul Lambert on the CFRG mailing list during discussion on the draft. It doesn't really matter which one you choose, as long as you're consistent about it!






    share|improve this answer









    $endgroup$













    • $begingroup$
      Thanks for the explanation. I didn't spot the little difference on a24 definition between the RFC and the EFD.
      $endgroup$
      – Pierre
      1 hour ago














    4












    4








    4





    $begingroup$

    This is not a bug: it arises from different choice of sign in the definition of a24 := (a ± 2)/4; the RFC uses - while the EFD uses +.



    RFC, following the Curve25519 paper:




    The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and (156326 - 2) / 4 = 39081 for curve448/X448.




    EFD, following Montgomery's paper (paywall-free):




    Assumptions: 4*a24=a+2.




    This apparent discrepancy was raised by Paul Lambert on the CFRG mailing list during discussion on the draft. It doesn't really matter which one you choose, as long as you're consistent about it!






    share|improve this answer









    $endgroup$



    This is not a bug: it arises from different choice of sign in the definition of a24 := (a ± 2)/4; the RFC uses - while the EFD uses +.



    RFC, following the Curve25519 paper:




    The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and (156326 - 2) / 4 = 39081 for curve448/X448.




    EFD, following Montgomery's paper (paywall-free):




    Assumptions: 4*a24=a+2.




    This apparent discrepancy was raised by Paul Lambert on the CFRG mailing list during discussion on the draft. It doesn't really matter which one you choose, as long as you're consistent about it!







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered 3 hours ago









    Squeamish OssifrageSqueamish Ossifrage

    19.3k12883




    19.3k12883












    • $begingroup$
      Thanks for the explanation. I didn't spot the little difference on a24 definition between the RFC and the EFD.
      $endgroup$
      – Pierre
      1 hour ago


















    • $begingroup$
      Thanks for the explanation. I didn't spot the little difference on a24 definition between the RFC and the EFD.
      $endgroup$
      – Pierre
      1 hour ago
















    $begingroup$
    Thanks for the explanation. I didn't spot the little difference on a24 definition between the RFC and the EFD.
    $endgroup$
    – Pierre
    1 hour ago




    $begingroup$
    Thanks for the explanation. I didn't spot the little difference on a24 definition between the RFC and the EFD.
    $endgroup$
    – Pierre
    1 hour ago











    4












    $begingroup$

    This is not a typo; it is a difference in how the Montgomery doubling formula was derived between the original paper and the curve25519 paper. Both are correct.



    To double a point on a Montgomery curve
    $$
    y^2 = x^3 + Ax^2 + x,,
    $$
    one has the identity relating the doubled point $(x_3, cdot)$ and the source point $(x_1, cdot)$:
    $$
    x_3 4x_1(x_1^2 + Ax_1 + 1) = (x_1^2 - 1)^2,.
    $$
    The doubled point $x_3$ can thus be computed as the fraction
    $$
    frac{(x_1^2 - 1)^2}{4x_1(x_1^2 + Ax_1 + 1)},.
    $$
    But to minimize the operation number, and obtain several common subexpressions, we can write $(x_1^2 - 1)^2$ as $(x_1+1)^2(x_1-1)^2$, $4x_1$ as $(x_1 + 1)^2 - (x_1 - 1)^2$, and $x_1^2 + Ax_1 + 1$ as either $(x_1-1)^2 + ((A+2)/4)4x_1$ or $(x_1+1)^2 + ((A-2)/4)4x_1$. It is this latter somewhat arbitrary choice that results in there being two almost identical Montgomery doubling formulas.






    share|improve this answer









    $endgroup$


















      4












      $begingroup$

      This is not a typo; it is a difference in how the Montgomery doubling formula was derived between the original paper and the curve25519 paper. Both are correct.



      To double a point on a Montgomery curve
      $$
      y^2 = x^3 + Ax^2 + x,,
      $$
      one has the identity relating the doubled point $(x_3, cdot)$ and the source point $(x_1, cdot)$:
      $$
      x_3 4x_1(x_1^2 + Ax_1 + 1) = (x_1^2 - 1)^2,.
      $$
      The doubled point $x_3$ can thus be computed as the fraction
      $$
      frac{(x_1^2 - 1)^2}{4x_1(x_1^2 + Ax_1 + 1)},.
      $$
      But to minimize the operation number, and obtain several common subexpressions, we can write $(x_1^2 - 1)^2$ as $(x_1+1)^2(x_1-1)^2$, $4x_1$ as $(x_1 + 1)^2 - (x_1 - 1)^2$, and $x_1^2 + Ax_1 + 1$ as either $(x_1-1)^2 + ((A+2)/4)4x_1$ or $(x_1+1)^2 + ((A-2)/4)4x_1$. It is this latter somewhat arbitrary choice that results in there being two almost identical Montgomery doubling formulas.






      share|improve this answer









      $endgroup$
















        4












        4








        4





        $begingroup$

        This is not a typo; it is a difference in how the Montgomery doubling formula was derived between the original paper and the curve25519 paper. Both are correct.



        To double a point on a Montgomery curve
        $$
        y^2 = x^3 + Ax^2 + x,,
        $$
        one has the identity relating the doubled point $(x_3, cdot)$ and the source point $(x_1, cdot)$:
        $$
        x_3 4x_1(x_1^2 + Ax_1 + 1) = (x_1^2 - 1)^2,.
        $$
        The doubled point $x_3$ can thus be computed as the fraction
        $$
        frac{(x_1^2 - 1)^2}{4x_1(x_1^2 + Ax_1 + 1)},.
        $$
        But to minimize the operation number, and obtain several common subexpressions, we can write $(x_1^2 - 1)^2$ as $(x_1+1)^2(x_1-1)^2$, $4x_1$ as $(x_1 + 1)^2 - (x_1 - 1)^2$, and $x_1^2 + Ax_1 + 1$ as either $(x_1-1)^2 + ((A+2)/4)4x_1$ or $(x_1+1)^2 + ((A-2)/4)4x_1$. It is this latter somewhat arbitrary choice that results in there being two almost identical Montgomery doubling formulas.






        share|improve this answer









        $endgroup$



        This is not a typo; it is a difference in how the Montgomery doubling formula was derived between the original paper and the curve25519 paper. Both are correct.



        To double a point on a Montgomery curve
        $$
        y^2 = x^3 + Ax^2 + x,,
        $$
        one has the identity relating the doubled point $(x_3, cdot)$ and the source point $(x_1, cdot)$:
        $$
        x_3 4x_1(x_1^2 + Ax_1 + 1) = (x_1^2 - 1)^2,.
        $$
        The doubled point $x_3$ can thus be computed as the fraction
        $$
        frac{(x_1^2 - 1)^2}{4x_1(x_1^2 + Ax_1 + 1)},.
        $$
        But to minimize the operation number, and obtain several common subexpressions, we can write $(x_1^2 - 1)^2$ as $(x_1+1)^2(x_1-1)^2$, $4x_1$ as $(x_1 + 1)^2 - (x_1 - 1)^2$, and $x_1^2 + Ax_1 + 1$ as either $(x_1-1)^2 + ((A+2)/4)4x_1$ or $(x_1+1)^2 + ((A-2)/4)4x_1$. It is this latter somewhat arbitrary choice that results in there being two almost identical Montgomery doubling formulas.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered 2 hours ago









        Samuel NevesSamuel Neves

        7,6402641




        7,6402641






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Cryptography Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid …



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            Use MathJax to format equations. MathJax reference.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67942%2fdifference-on-montgomery-curve-equation-between-efd-and-rfc7748%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            -

            Popular posts from this blog

            Сан-Квентин

            Image
            Сан-Квентин Местоположение Сан-Квентин, Калифорния Координаты 37°56′13″ с. ш. 122°29′20″ з. д. H G Я O L Текущий статус Действует Режим безопасности минимальный и максимальный Количество мест 3 302 Открытие Июнь 1852 Находится в ведомстве California Department of Corrections and Rehabilitation Начальник Mike Martel, начальник  Сан-Квентин на Викискладе Сан-Квентин (англ.  San Quentin ) — тюрьма, располагающаяся на 432 акрах (около 1,7 км²), на мысе Сан-Квентин, в округе Марин, штат Калифорния, США. Тюрьма штата Калифорния Сан-Квентин была открыта в июле 1852 года и является старейшей в штате. Она была построена заключёнными, которые проживали в течение строительства на тюремном судне Вабан. В Сан-Квентине отбывали наказание и мужчины, и женщины до 1934 года, когда построили женскую тюрьму в Техачапи и туда перевели всех заключённых женщин. В Сан-Квентине приводятся в исполнение смертные казни, для этого имеется газовая камера, но...
            Read more

            8-я гвардейская общевойсковая армия

            Image
            8-я гвардейская общевойсковая ордена Ленина армия Награды: Войска: РККА → Советская армия → СВ России Род войск: Формирование: 1943 Расформирование (преобразование): 1992 Предшественник: 62-я армия (1942—43) → 8-я гвардейская общевойсковая армия (1943—92) → 8-й гвардейский армейский корпус (1992—98) Боевой путь Изюм-Барвенковская операция Донбасская операция Запорожская операция Битва за Днепр Днепропетровская операция Березнеговато-Снигирёвская операция Одесская операция Люблин-Брестская операция Варшавско-Познанская операция Восточно-Померанская операция Берлинская наступательная операция У этого термина существуют и другие значения, см. 8-я армия. Фотография Гвардейского Красного Знамени (лицевая сторона) 8-й гвардейской армии , образца 1943 года. Фотография Гвардейского Красного Знамени (оборотная сторона) 8-й гвардейской армии , образца 1943 года. 8-я гвардейская общевойсковая ордена Ленина армия  — гвардейское фор...
            Read more

            Алькесар

            Image
            Муниципалитет Алькесар Alquézar Герб 42°10′16″ с. ш. 0°01′27″ в. д. H G Я O L Страна Испания   Испания Автономное сообщество Арагон Провинция Уэска Комарка Сомонтано-де-Барбастро Алькальд Хосе Марияно Альтемир Ласкорс (ИСРП) История и география Площадь 32,36 км² Высота НУМ 660 м Часовой пояс UTC+1, летом UTC+2 Население Население 313 человек ( 2010 ) Плотность 9,92 чел./км² Этнохороним alquezarano/-a Цифровые идентификаторы Телефонный код +34 974 Почтовые индексы 22112 Автомобильный код HU alquezar.org   (исп.) Показать/скрыть карты Алькесар Алькесар Алькесар  Аудио, фото и видео на Викискладе Алькесар (исп.  Alquézar ) — муниципалитет в Испании, входит в провинцию Уэска, в составе автономного сообщества Арагон. Муниципалитет находится в составе района (комарки) Сомонтано-де-Барбастро. Занимает площадь 32,36 км². Население — 321 челове...
            Read more