Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Dan Brown <[e-mail]>]

> From: Phillip Hallam-Baker
> Sent: Tuesday, February 10, 2015 10:14 AM

> The two places we will be using the code is for ephemeral key agreement and 
> for initial agreement of a
> master key. Assuming that we fix the TLS key derivation alg so that a 128 
> bit ephemeral does not weaken a
> 256 bit negotiation, I predict ephemeral will be exclusively Curve 25519 and 
> PKI will be exclusively
> Curve~512.

Counterarguments for the opposite, i.e. 128-bit security for PKI and 256-bit 
security for key agreement. First, confidentiality often relies key agreement 
and confidentiality potentially needs long-term (future) security, so 
margin-of-error is arguably more important. PKI, by definition, is only as 
secure as the security of CAs and the security of the communication used to 
obtain their CA self-signed certificates: larger key sizes does not fix these 
two bottlenecks.