4 ms·

For anyone following this part of the comment thread, the mailing list discussion about these topics is worth a read too: https://www.ietf.org/mail-archive/web

• acqq 11y ago
  The text sketches a proof how PinkBikeShed from Microsoft is worse. He also ends with "I didn't bother writing down a comprehensive critique of PinkBikeShed, and didn't imagine that anyone would ever try to revive that curve."
  • tptacek 11y ago
    It's a whole lot of sentences for a very simple difference. I think "proof" is pushing it a bit far.
    • acqq 11y ago
      He wrote a lot, but it's very clear what his principles in this case are. To be constructive, other experts should either point to the principles with which they disagree or if they do agree point to the errors in his use of them.
      • tptacek 11y ago
        In that argument, Microsoft would say that performance being equal, it's more important for parameters to be minimal so that the curve is maximally rigid and trustworthy. Bernstein would say that it's more important that there are no implementation pitfalls, even very subtle ones that will be hard to exploit. I agree with Bernstein but I won't pretend it's a totally cut and dried argument. What won the argument wasn't so much the merits of Bernstein's case, but that Microsoft was in effect arguing for something that would break compatibility with the 25519 installed base.