# Twisted curves in protocol

I've come to understand that twisted curves, as for instance defined in the Brainpool specifications, are $F(p)$-isomorphic to their regular $F(p)$ equivalents. So brainpoolP256r1 is isomorphic to brainpoolP256t1.

In a protocol, does it make sense to specify support for twisted curves? Should it be possible to specify the twisted curve OID instead of the $F(p)$ equivalent? If so, could using the twisted curve representation of the curve have any performance benefits over the regular representation? Or is the twisted curve representation only used for the security analysis of the curve?

-

If so, could using the twisted curve representation of the curve have any performance benefits over the regular representation?

Yes, at least in some cases. To quote Twisted Edwards Curves (section 7):

One can choose $a$ to be very small, making twisted Edwards curves essentially as fast as Edwards curves and thus bringing the speed of the Edwards addition law to a wider variety of elliptic curves.

Even when an elliptic curve can be expressed in Edwards form, expressing the same curve in twisted Edwards form often saves time in arithmetic.

Or is the twisted curve representation only used for the security analysis of the curve?

In addition to the above, twists can also be used to make ciphertexts indistinguishable from random data like in A Public-Key Encryption Scheme with Pseudo-Random Ciphertexts (pdf).

-
Would you consider it useful for a protocol to include support for twisted curve OID's in your opinion? If they are isomorphic, wouldn't it be better to simply leave it to the system to choose the best implementation? I'm guessing this won't work because the key values would be different? –  Maarten Bodewes Jun 5 '14 at 15:33
@owlstead: I guess it depends on the protocol – if it involves transmitting curve points to another implementation (e.g. ECDH) it could be useful to be able to do that on a particular twist. If it doesn't, that seems like an implementation detail. –  otus Jun 5 '14 at 15:39
To clarify: for e.g. public keys it wouldn't be that big a deal to convert between representations once, but for something like ECDSA it would. –  otus Jun 5 '14 at 15:43