# ed448 generator choice in supercop

Mike Hamburg proposed the Ed448-Goldilocks curve and submitted a software implementation for it to the SUPERCOP project.

Below you can see that MH picked a generator (or base point) that has a y-coordinate equal to 19.

(I would guess that points with y=0..18 are somehow not suitable and that y=19 is the first good point -- could someone confirm this?)

Confusingly, there are two other generators specified in MH's iacr eprint: one generator is from the original version of the paper, and the second is from an updated version. Both versions can be downloaded here. Those generators do not appear in the SUPERCOP sources.

$cd supercop-20220506/crypto_sign/ed448goldilocks/64$ grep -A 13 base_point magic.c
const struct affine_t goldilocks_base_point = {
#ifdef USE_NEON_PERM
{{ 0xaed939f,0xc59d070,0xf0de840,0x5f065c3, 0xf4ba0c7,0xdf73324,0xc170033,0x3a6a26a,
0x4c63d96,0x4609845,0xf3932d9,0x1b4faff, 0x6147eaa,0xa2692ff,0x9cecfa9,0x297ea0e
}},
#else
{{ U58LE(0xf0de840aed939f), U58LE(0xc170033f4ba0c7),
U58LE(0xf3932d94c63d96), U58LE(0x9cecfa96147eaa),
U58LE(0x1b4faff4609845), U58LE(0x297ea0ea2692ff)
}},
#endif
{{ 19 }}
};

Note that the SUPERCOP software appears to be an early version of MH's libdecaf library. However, the SUPERCOP package is somewhat easier to navigate since all relevant source files are together in one directory.

• RFC 7748 Appendix A covers the generation algorithm for the parameters typically used here and may be illustrative for your particular question. Aug 18 at 1:40
• Thanks for the pointer to RFC 7748. The method there for selecting a generator uses the Montgomery form, v^2 = u^3 + A*u^2 + u. It starts with u=1, computes v (if possible), and then checks if (u,v) has the desired properties; if not, then u is incremented and we try again. This process explains how the generators for Ed25519 and Ed448 in RFC 8032 were derived, but it does not explain the magic values in the SUPERCOP software. Aug 19 at 2:24
• If I could edit my previous comment, then I would change "Ed25519" to "edwards25519" and "Ed448" to "edwards448" since I was referring to the curves. Ed25519 and Ed448 refer to EdDSA variants. Sep 9 at 18:47