Re: [Cfrg] Minimum required work force for additional curve

Hi Kurt,

My view is that once we have a ~WF-128 curve, there’s not that much point in hedging against rho attacks run by faster computers.  This is because in the next few decades, the NSA-KGB-lizardman alliance probably won’t have enough compute power to break Curve25519.  Even if they do, they probably aren’t going to run a computation whose waste heat boils Lac Léman  to read your email, or for that matter, Angela Merkel’s email.  Instead, a stronger curve should be something which (a) might not fall to a math breakthrough which breaks the fast one, and (b) gets people on board who ask “but is there a stronger one” (basically the PHB angle).

For both of these, we want something much bigger than WF-128.  Exactly how much bigger is a nebulous tradeoff of field size, performance and marketability, which is why we’re still having this sort of discussion.

I’m guessing that users who actually need both WF-144+ security against rho attacks and performance better than a WF-192+ curve can provide are a small minority.  If you have some users in mind, though, I’m all ears.

— Mike

> On Feb 26, 2015, at 11:03 AM, Kurt Roeckx <kurt@roeckx.be> wrote:
> 
> Since I think this hasn't been clearly asked and that it might
> explain the answer on the other questions asked, I'm guess I'll
> just ask it myself:
> 
> Assuming other than the 128 WF curve we only add 1 other curve,
> what is the minimum WF it should have?
> 
> I'm proposing the following answers, each time 16 bit more:
> 144
> 160
> 176
> 192
> 208
> 224
> 240
> 256
> 
> 
> Kurt
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg