> On Sep 4, 2018, at 12:10 PM, Michael Richardson <mcr@xxxxxxxxxxxx> wrote: > > My understanding is that you need x and y to do the computation. > (And I observe this in code) The Y coordinate is not needed for X25519 and X448 Diffie-Helman key agreement, these operate on the X (sometimes called "u") coordinate only. The Ed25519 and Ed448 algorithms do use compressed-encodings with one bit used to disambiguate the choice of square-root for one of the coordinates. With Edwards form the choice of which to to compress is arbitrary, the curve is invariant under exchange of x and y or change of either sign. https://tools.ietf.org/html/rfc8032#section-5.1.2 https://tools.ietf.org/html/rfc8032#section-5.2.2 -- -- Viktor. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
