Informal Minutes of the IEEE P1363 Teleconference.
23 May 1997, 10 am PDT.

In attendance: Lily Chen, David Jablon, Burt Kaliski, Alfred Menezes,
Leo Reyzin, Roger Schlafly, Jerry Solinas.

Issues discussed:

1.  Burt reported on the May meeting.  He pointed out that the meeting
didn't last as long as planned and adjourned after the Friday morning
session, rather last through the entire day on Friday.  He recommended
that if we were to plan a meeting like this again, we could just limit
it to Thursday afternoon.  Alternatively, we could have a longer meeting
in Europe, that would focus on more details, but that probably wouldn't
be in conjunction with a major conference.

2.  Burt also reported on the status of patent solicitation responses.
He got a letter from Certicom stating possible coverage of point
compression and MQV.  Rueppel and Schnorr were preparing responses, as
well.

3.  We went on to discuss the latest editorial contribution Leo posted
for the teleconference participants.  The strategy was to have a fairly
complete main body of the document, in IEEE style, ready for review at
the June meeting.   Leo said he would add the section on Elliptic Curves
once the Discrete Logarithm section is more settled; at the very least
he would try to add the primitives that differ significantly from the DL
primitives (such as Diffie-Hellman or MQV).  Leo and Jerry will work on
cofactor verification for EC, which should be easy now that the relevant
algorithm is in Appendix F.

4.  Lily pointed out that the currently we require that if F2^m is
represented as an extension of F2^d (d>1), then they both be represented
in the same type of basis (i.e., if F2^d is represented in polynomial
basis over F2, then F2^m has to be represented in polynomial basis over
F2^d; same for normal basis).  We had a discussion of whether we want to
allow polynomial representations over normal representations and normal
representations over polynomial representations.  We decided not to, for
the following reasons: it would complicate the descriptions; it would
adversely affect interoperability; representation over F2^d is most
often used when there is room to represent operations over F2^d by
tables, and in that case keeping another table for conversion of F2^d
from one basis to another would not add significantly to memory
requirements, if an application chooses to use a mixed internal
representation.  We decided, however, to explain that an implementation
may choose to do this and include more information on basis conversion.

5.  Roger asked why the bit strings were again in the document.  Leo
explained the reasons from the March meeting, but pointed out that he
encountered difficulties when writing the auxiliary functions section,
and said that some work was needed to incorporate both bit strings and
octet without making the document too confusing and unwieldy.

6.  Jerry said he was fixing some algorithms in Appendix (including
factoring polynomials) and would provide Leo with the new version
shortly.

7.  We went over point compression, to make sure it worked for all kinds
of bases.  It did.  It didn't work over F2^m if x = 0; Jerry said he
would fix it.  People made other suggestions to improve the document
(such as providing more examples to enhance the presentation), which Leo
recorded.

8.  Regarding plans for the near future, we agreed to review the main
body in detail at the June meeting and work intensively on the
appendices between the June and the August meetings.  Leo asked for more
comments on the document before the June meeting.

We adjourned at about 11 am PDT.