ChristopherA
commented
2 years ago In particular, some other useful links on this topic:
- Cofactor Explained: Clearing Elliptic Curves' dirty little secret
- Prime, Order Please! Revisiting Small Subgroup and Invalid Curve Attacks on Protocols using Diffie-Hellman - IACR
- Exploiting Low Order Generators in One-Time Ring Signatures - nickler's
- Why Ristretto? - The Ristretto Group
- The ristretto255 Group - draft-irtf-cfrg-ristretto255-00
PENDING: Commitment to 25159, Ristretto
Current notes at https://hackmd.io/ea_Y7AvySOOo5sESVFX1hA but needs updating with more details of multisig problems, FROST, etc.
Do before, or as a followup to, a cryptowatch article?
Why 25519 HD-Keys are bad
Dependency: Identity Sponsor using 25519