Re-review after latest changes

[fscoto]

• canonical spellings (mostly lowercasing despite being proper nouns because upstream said so)
• nbsp and other formatting and style and grammar nits
• use proper typographic apostrophes
• consequent usage of q for field prime
• clarify licensing; closes #1
• formulas: help for weird prime fields These do happen with pseudorandomly generated curves, e.g. brainpoolP384r1 has a field prime that is 1 (mod 4) and 1 (mod 8).
• prefer over zero width spaces less trouble when copying and pasting
• kex: clamp uses |, not +
  • would overflow the sign bit!
• kex: avoid talking about death could be a legitimate trigger word; no need to invite these debates
• map: more consistent variable naming
• map: bump I-D number of h2c
• map: fix curve448 field
• map: Clarify q=2 impossible
• map: Not all short Weierstraß curves have prime order current sentence implies this, but this isn't always the case Example: Wei25519 (I-D.draft-ietf-lwig-curve-representations-23, § 2).
• map: s/Some/The following/ conditions lest the text imply that the list of conditions isn't finite
• map: intro: unify quotes for introducing terms stop mixing italics and quotes.
• don't link directly to PDF instead link to the abstract mobile users report frequently that PDFs seem to be an issue for them

[fscoto]

Open questions:

• Why is the Legendre symbol function called chi() in the reference implementation?
• formulas.txt talks about Z_u and Z_v with no explanation; what even are those?

[LoupVaillant]

@fscoto to answer your questions:

The chi() name comes from the fact that traditionally the Legendre symbol is written with the corresponding greek letter. We should replace every instance of chi by legendre like you established earlier.

I'll think about explaining Z_u and Z_v more clearly: the short of it is, they're constants derived from the non-square Z.

[LoupVaillant]

@fscoto I've reviewed formulas.txt, and there is some explanation about Z_u and Z_v:

Where A, is a curve constant, Z an arbitrary non-square parameter, and Z_u and Z_v constants derived from Z. In practice, Z is chosen in a way that minimises computation: either a small number, or something that eliminates Z_u and Z_v.

Then the curve parameters tell us exactly how to derive Z_u and Z_v.

Perhaps you saw those, and judged that it was not enough?

---

One thing that I did omit was why Z_u and Z_v are the way they are. Long story short, this comes from isr(), which works differently on non-squares depending on what p (err, q) is congruent with. But that level of explanation, I believe, belongs to the realm of deep maths — proofs. In my opinion, such proofs do not belong to a page dedicated to just giving people the solution. We could however have a dedicated proof page. It would be nice to have, but I personally don't think we should make it a priority.