# Tag Info

2

The relevant part of Neven et al is this: What this means for practice is that one should not instantiate the hash function with a Merkle-Damgård iteration of an $n$-bit compression function. Instead, one should probably simply truncate the output of a $2n$-bit hash function to $n$ bits. (Such a method would in our situation be reminiscent of Lucks’ ...

6

First off, your equation is correct and there seems to be no calculation mistake. To understand on how to get from $$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$ to $$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$ one first needs to observe that $e=(d-2)/(d+2)=121665/121666$ holds. The next step is to consider: "What operations are actually allowed with birational ...

0

The section 'Radix-$2^{64}$ representation' on page 11 of the Ed25519 paper ("High-speed high-security signatures" by Bernstein et al.) actually explains the technique. I should have read the paper more carefully. As pointed out by CodesInChaos, the order of the field is $p=2^{255}-19$ and the 38 corresponds to $2p=2^{256}-38$.

Top 50 recent answers are included