why did Ed25519 used Edward25519 instead of Curve25519 directly?
-
-
The reasons the CFRG stood by it are: - simple point decoding - Montgomery ladder favors small code size and constant time implementations That said, every time I see someone convert from Edwards to Montgomery form to do D-H I

-
Great in theory if you only need DH, but in the real world, most applications need both DH and signatures. So long for the small code size. Plus, yes, conversions, that are neither cheap nor required.
- 2 more replies
New conversation -
-
-
Scalar multiplication with an arbitrary point by Montgomery ladder on Curve25519 is still faster than on Ed25519, isn't it?
-
With a variable base, yes, albeit not significantly with common optimization techniques (windows, etc). A single curve for DH and signatures is convenient and implementations can be smaller. The tradeoff is well worth it for most applications.
- 2 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.