Re: [Cfrg] When in doubt, err on the side of security

[Watson Ladd <[e-mail]>]

On Oct 20, 2014 11:37 AM, "Igoe, Kevin M." <[e-mail]> wrote:
>
> Once a security primitive has been selected, Moore’s law will naturally
improve its
>
> performance with the passage of time.   But Moore’s law and advances in
>
> cryptanalysis will only erode its security (measured in the money needed
to run
>
> the attack).  Bottom line: err on the side of security.

Truisms like that are rarely helpful, and this is no exception. First,
Moores law amplifies, not erases, performance issuses: users want to do
more with cheaper crypto. How much this matters is an economic question.
Sadly we've already ruled out the fastest options for somewhat decent
reasons, as a glance at eBATS will show.

The second issue is that the choice between performance and security is
made worse by the absence of intermediate options. An organization that
strained and strained to get adequate performance out of ed448goldilocks
isn't made more secure by a standard only offering a 521 bit and 256 bit
curve, as they will reduce security to get adequate performance. The
tradeoff doesn't need to be that extreme for this to happen.

I haven't seen good arguments for approving two curves at the far ends of
the performance scale, instead of picking inflection points where a small
increase in time yields a large increase in security. What I've seen is
arguments that ignore the revealed preferences of users.

Thirdly, I recall more Z80 processors are produced today then in the days
of the microcomputer. Moore's law can be used to increase performance or
reduce price.

Interestingly, the NSA is no stranger to this issue. Suite B did not use
the highest security for everything, presumably for performance reasons. In
some cases the US Army uses very breakable ciphers, because the alternative
is no cipher and the material isn't that sensitive.  (If the message is
"Attack at dawn", decrypting at 9 am isn't terribly helpful to the enemy)

In conclusion performance still matters.

Sincerely,
Watson Ladd
>
>
>
>
>
> ----------------+--------------------------------------------------
>
> Kevin M. Igoe   | "We can't solve problems by using the same kind
>
>[e-mail]  | of thinking we used when we created them."
>
>                 |              - Albert Einstein -
>
> ----------------+--------------------------------------------------
>
>
>
>
> _______________________________________________
> Cfrg mailing list
>[e-mail]
>http://www.irtf.org/mailman/listinfo/cfrg
>