On Fri, Apr 7, 2017 at 5:07 PM, Gregory Maxwell <gmaxw...@gmail.com> wrote:
> I think that people should really consider curves with cofactor 1. > Outside of the DH context I think e.g. secp256k1 has some very nice properties for signatures, but it seems fairly common to want to use the same curve for signatures and D-H, such as the Lightning Network adapting Trevor's Noise protocol to use secp256k1 for D-H. I think it's probably worth considering both the signatures and D-H use cases. In regard to hierarchical key derivation which addresses both signatures and D-H cases using Curve25519, the torsion safe representatives scheme from the Tor developers seems to do this relatively elegantly. -- Tony Arcieri
_______________________________________________ Curves mailing list Curves@moderncrypto.org https://moderncrypto.org/mailman/listinfo/curves
