proposal: crypto/elliptic: add A to CurveParams, allowing some cases of A != -3 #26776
Description
The following addition to CurveParams is proposed:
type CurveParams struct {
// ...
A *big.Int // the coefficient of x in the curve equation
// ...
}The groups from bn256 can be considered instances of elliptic.Curve with this modification, being Koblitz curves with A = 0, B = 3. I suspect the G1 implementation can be repurposed as a general variable-time implementation for A = 0 curves, as the implementation derives from the study of this class of curves, which only assumes that A = 0.
Some support for the named Koblitz curves in SEC 2 can also be added (so A = 0 or A = -1 (mod P) also possible).
Parsing X.509 keys which use these curves with crypto/x509 should also work. This means keys and certificates which use the Koblitz curves will be supported by the tls module. Refer to RFC 4492 Section 5.1.1 for their corresponding enum values.
Also would like to remark that all Montgomery curves admit a Weierstrass form (and the computational speedup for computing operations on e.g. Curve25519, can be thought of as implementation details). In fact, all elliptic curves could be correctly implemented by elliptic.Curve with this modification. Curve/Ed25519 is isomorphic to a curve group defined by a short Weierstrass form equation, but this is not the case in general.