Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I've come to understand that twisted curves, as for instance defined in the Brainpool specifications, are $F(p)$-isomorphic to their regular $F(p)$ equivalents. So brainpoolP256r1 is isomorphic to brainpoolP256t1.

In a protocol, does it make sense to specify support for twisted curves? Should it be possible to specify the twisted curve OID instead of the $F(p)$ equivalent? If so, could using the twisted curve representation of the curve have any performance benefits over the regular representation? Or is the twisted curve representation only used for the security analysis of the curve?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted
+100

If so, could using the twisted curve representation of the curve have any performance benefits over the regular representation?

Yes, at least in some cases. To quote Twisted Edwards Curves (section 7):

One can choose $a$ to be very small, making twisted Edwards curves essentially as fast as Edwards curves and thus bringing the speed of the Edwards addition law to a wider variety of elliptic curves.

Even when an elliptic curve can be expressed in Edwards form, expressing the same curve in twisted Edwards form often saves time in arithmetic.


Or is the twisted curve representation only used for the security analysis of the curve?

In addition to the above, twists can also be used to make ciphertexts indistinguishable from random data like in A Public-Key Encryption Scheme with Pseudo-Random Ciphertexts (pdf).

share|improve this answer
    
Would you consider it useful for a protocol to include support for twisted curve OID's in your opinion? If they are isomorphic, wouldn't it be better to simply leave it to the system to choose the best implementation? I'm guessing this won't work because the key values would be different? –  owlstead Jun 5 at 15:33
    
@owlstead: I guess it depends on the protocol – if it involves transmitting curve points to another implementation (e.g. ECDH) it could be useful to be able to do that on a particular twist. If it doesn't, that seems like an implementation detail. –  otus Jun 5 at 15:39
    
To clarify: for e.g. public keys it wouldn't be that big a deal to convert between representations once, but for something like ECDSA it would. –  otus Jun 5 at 15:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.