[CFRG] Curve25519 security level is better than stated in RFC 7748

[John Mattsson <[e-mail]>]

Hi,

Dan recently corrected a statement I made in NIST pqc-forum about Curve25519 security level. RFC 7748 states that:

   The security level (i.e., the number of "operations" needed for a
   brute-force attack on a primitive) of curve25519 is slightly under
   the standard 128-bit level.

I think this statement is wrong or at least misleading. For a reader it is easy to get the understanding that Curve25519 offers less classical security than e.g., AES-128 when in fact the opposite is true. When using AES-128 and Curve25519 together, AES-128 is the weakest link (considering known classical attacks). Comparing asymmetric and symmetric "operations" are like comparing apples to oranges. When you make a fair comparison, it is very clear that Curve25519 is stronger than AES-128 based on known classical attacks. The original statement in the Curve25519 paper (https://cr.yp.to/ecdh/curve25519-20060209.pdf) seems much more accurate to me.

   Every known attack is more expensive than performing a
   brute-force search on a typical 128-bit secret-key cipher.

If RFC 7748 is ever updated, I think the security considerations should be updated.

Cheers,
John