Path: archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.acns.nwu.edu!news.cc.uic.edu!cr.yp.to!not-for-mail
From: d...@cr.yp.to (D. J. Bernstein)
Newsgroups: sci.crypt
Subject: Re: Current Consensus on ECC
Date: 9 Nov 2001 23:38:28 GMT
Organization: IR
Lines: 14
Message-ID: <2001Nov923.38.28.11895@cr.yp.to>
References:
NNTP-Posting-Host: muncher.math.uic.edu
X-Trace: newsx.cc.uic.edu 1005349892 2624 131.193.178.181 (9 Nov 2001 23:51:32 GMT)
X-Complaints-To: ne...@uic.edu
NNTP-Posting-Date: Fri, 9 Nov 2001 23:51:32 +0000 (UTC)
Xref: archiver1.google.com sci.crypt:45385
Roger Schlafly wrote:
> It makes sense if you have severe bandwidth contraints.
> If you are more interested in minimizing computation,
> then send x and y.
Montgomery's x-coordinate point-multiplication method, when applied to
curves of Montgomery's shape y^2 = x^3 + c_2 x^2 + x, is faster for
typical curve sizes than any known x,y point-multiplication method, so
you can happily skip both the y transmission and the square root.
In fact, if both the curve and its twist have nearly prime order, then
you can even skip square testing.
---Dan