Re: [Cfrg] Elliptic Curves - poll on specific curve around 256bit work factor (ends on February 23rd)

[Jon Callas <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256


On Feb 19, 2015, at 9:22 AM, Mike Hamburg <[e-mail]> wrote:

> Jon, if you're using Curve41417, do you have benchmarks for Curve41417 on x86 or amd64?  I've only ever seen their NEON benchmarks.

No, I only do it on ARM, and I'm using it as an alternative to P-384.

The decision we made in looking for ciphers was to reduce options. Our original plan was to have a 128-bit cipher suite and a 256-bit cipher suite, and have the default be 256, with fallback to 128 when performance wasn't good enough. That original decision was to have only one public key parameter, and that was P-384.

Even before the Snowden revelations, Dan Bernstein and Tanja Lange talked to me about elliptic curves, and in specific asking why we didn't use 25519, and my answer on 25519 was that I wanted greater than 128-bit security, and even at 128 bits, 25519 isn't *quite* 128. There's no *technical* reason to care about the difference, but it's good to be able to say, "I do at least 128 bits of security" and not have someone in the room point out that well, technically 25519 is some fraction of a bit lower in security.

They offered to design me a curve as a replacement for P-384. The result is 41417. It's a really nice curve, both intellectually and from a performance standpoint. Our naive implementations of 41417 performed just fine. Public key performance isn't a real problem for me -- good enough is good enough. P-384 was good enough.

The NEON implementation of 41417 is amazing. I'm sure getting an equivalent done for Intel is completely doable -- just pick what generation of vector instructions you want to support.

	Jon


-----BEGIN PGP SIGNATURE-----
Version: PGP Universal 3.3.0 (Build 9060)
Charset: us-ascii

wsBVAwUBVOYz3PD9H+HfsTZWAQgLowgAgs2bTlkfCKfGV3xgg8G29b9ymb6e0Viy
779bAob2E+raULDsYZw/h6y3V1U5dQ1mZgchfW/laoYqu4Xpl4b7CWryU04wZPGO
E/GyxqvB8ATL1z8aaszP9DKCedXy5doePDiDJeHjhkYYPjviydih7Bh+e9EH/YS4
VJ0lMrFT9PxuMe3/RgWBSqeyJo+Mn0+TmDMZE7UFjO/qKg6/fvVK38YHbSQPOg1B
o/xeirFaOmHv3k1oQJqrfQdZsxMsFHp3fmfRkfAgVO9KOBEMozy0Ofx/U0GOnYye
ofJtR3V9yoFxUpUjZXKexiJtRgkegkpq0qW+6jBE9eUhVGDIxuMyOg==
=XfBj
-----END PGP SIGNATURE-----