Re: [Cfrg] ECC reboot

[Andy Lutomirski <[e-mail]>]

On Thu, Oct 23, 2014 at 1:52 PM, Phillip Hallam-Baker
<[e-mail]> wrote:
> Having built large parallel machines and used them for very large tasks, I
> am going by a little more than common sense. 512 bit arithmetic operations
> are certainly going to be faster than 521. Now what that implies for
> implementing
> Knotted Weierstrass curves with a double Irish Dutch sandwich or whatever is
> what I am looking for an explanation of in terms that I can explain to the
> general security community.
>
>
> What I began arguing is that 521 is going to break stride on a 512 bit
> architecture and should be taken off the table unless the speed advantage is
> enormous. I don't think we need to implement the algorithm to see that.
>
> Now if you are arguing that 512 will also break stride on a 512 bit
> architecture then that is an important data point that by the same logic
> argues for looking at a curve that does fit and maybe Golilocks is actually
> the one.

I'm really having trouble understanding what you mean by "break
stride".  I doubt that any implementation of any of these algorithms
is even close to fast enough that the time it takes to shove data
across the bus is relevant.  If someone really builds special-purpose
ASICs for this, they they can presumably back a 521-bit register (or
any other size register) by a far smaller bus and get excellent
performance.

--Andy