3
$\begingroup$

I've come to understand that twisted curves, as for instance defined in the Brainpool specifications, are $F(p)$-isomorphic to their regular $F(p)$ equivalents. So brainpoolP256r1 is isomorphic to brainpoolP256t1.

In a protocol, does it make sense to specify support for twisted curves? Should it be possible to specify the twisted curve OID instead of the $F(p)$ equivalent? If so, could using the twisted curve representation of the curve have any performance benefits over the regular representation? Or is the twisted curve representation only used for the security analysis of the curve?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
2
+100
$\begingroup$

If so, could using the twisted curve representation of the curve have any performance benefits over the regular representation?

Yes, at least in some cases. To quote Twisted Edwards Curves (section 7):

One can choose $a$ to be very small, making twisted Edwards curves essentially as fast as Edwards curves and thus bringing the speed of the Edwards addition law to a wider variety of elliptic curves.

Even when an elliptic curve can be expressed in Edwards form, expressing the same curve in twisted Edwards form often saves time in arithmetic.

Or is the twisted curve representation only used for the security analysis of the curve?

In addition to the above, twists can also be used to make ciphertexts indistinguishable from random data like in A Public-Key Encryption Scheme with Pseudo-Random Ciphertexts (pdf).

Improve this answer
$\endgroup$
3
  • $\begingroup$ Would you consider it useful for a protocol to include support for twisted curve OID's in your opinion? If they are isomorphic, wouldn't it be better to simply leave it to the system to choose the best implementation? I'm guessing this won't work because the key values would be different? $\endgroup$
    – Maarten Bodewes ♦
    Jun 5, 2014 at 15:33
  • $\begingroup$ @owlstead: I guess it depends on the protocol – if it involves transmitting curve points to another implementation (e.g. ECDH) it could be useful to be able to do that on a particular twist. If it doesn't, that seems like an implementation detail. $\endgroup$
    – otus
    Jun 5, 2014 at 15:39
  • $\begingroup$ To clarify: for e.g. public keys it wouldn't be that big a deal to convert between representations once, but for something like ECDSA it would. $\endgroup$
    – otus
    Jun 5, 2014 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.