Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

Andy Lutomirski <luto@amacapital.net> Wed, 04 March 2015 02:25 UTC

Return-Path: <luto@amacapital.net>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 877DA1A1EEC for <cfrg@ietfa.amsl.com>; Tue, 3 Mar 2015 18:25:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.979
X-Spam-Level:
X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OGlRY37CnBg8 for <cfrg@ietfa.amsl.com>; Tue, 3 Mar 2015 18:25:18 -0800 (PST)
Received: from mail-la0-f52.google.com (mail-la0-f52.google.com [209.85.215.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6AC81A1BEC for <cfrg@irtf.org>; Tue, 3 Mar 2015 18:25:17 -0800 (PST)
Received: by labgm9 with SMTP id gm9so1923640lab.8 for <cfrg@irtf.org>; Tue, 03 Mar 2015 18:25:16 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=UaWBGidaDVSW4NXzMSrMxNJHfQXNs+k4zoZn4+6RN9c=; b=jBVPXSw8vO5vgpA3sRUlGu7md4Bps5aap3g8ap0DtO/BtXSHLGqbcAMlFgEc7oYyTZ y0ugCJp6OB/N2mcmUd/7j8obKaG3icn7Ks78iKCEiBQIQVm4iRVyy3PkKQD/YkzhZt0h 7oPfe0lQi9guQnj/LItTPoS/pZH9oLkZQly73m4vveXRfh3YCFej1hAbliF0msECdjuT t3NMAERucWwjZK5QiVbc48NdIqe8wgtjgQLuqkyRnTlqvEv1xGXgsPPVTwlrD5iWLxlj 5jAgxQTNbo+X1iSzcMil+vpqm345kPEwIIdl8Wm1bgqk05wYV4zrEVpzXKZPK7M0T2/G IK9w==
X-Gm-Message-State: ALoCoQnoQZvHf57WjtQ9Cxo4BIVlYoq+3WCbOYN+1+0INjzkUVVRHm4BwK/IOJCUaD3x93mWbVen
X-Received: by 10.152.26.136 with SMTP id l8mr1338267lag.109.1425435916098; Tue, 03 Mar 2015 18:25:16 -0800 (PST)
MIME-Version: 1.0
Received: by 10.152.111.232 with HTTP; Tue, 3 Mar 2015 18:24:55 -0800 (PST)
In-Reply-To: <CAMm+Lwit7UW3BZUAiariwqqt+0ut6eDVuL9MO7i-_6vwv4kPgA@mail.gmail.com>
References: <54EDDBEE.5060904@isode.com> <54EDEE67.1010102@cs.tcd.ie> <CAMm+Lwit7UW3BZUAiariwqqt+0ut6eDVuL9MO7i-_6vwv4kPgA@mail.gmail.com>
From: Andy Lutomirski <luto@amacapital.net>
Date: Tue, 03 Mar 2015 18:24:55 -0800
Message-ID: <CALCETrW7VYBr8_XzoyVg7V2yZEEcOF-tvC_eEtZqd9aGB-Cpcw@mail.gmail.com>
To: Phillip Hallam-Baker <phill@hallambaker.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/6W3gBbqhEr4MXVpdirZgwZB2pFw>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Mar 2015 02:25:19 -0000

On Wed, Feb 25, 2015 at 8:22 AM, Phillip Hallam-Baker
<phill@hallambaker.com> wrote:
> Do we have figures for performance of these versus RSA2048?
>
> Yes, we get a reversal of the public/private speed advantage on signature.
> And that in itself is a huge win on the server side
>
> RSA signature verification takes 0.16 ms on a reasonably current machine
> (signature is 6ms)
>
> http://www.cryptopp.com/benchmarks.html
>
> How much faster/slower one curve is over another matters much less to me
> than whether the curve is faster or slower than what I am already using. I
> am not going to be using P521 or P448 curves on a constrained device, I will
> go for P255.
>
> If we had figures comparing the curve candidates to RSA it would probably be
> illuminating.

It seems to me that, if you're currently using RSA 2048, then you
might as well just use Curve25519.  A higher security margin curve
would be a replacement for RSA 4096 or even larger, I imagine.

--Andy