Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Yoav Nir <[e-mail]>]

> > For Q2: for Russia it is of primary importance that the curve is strictly
> > 512-bit, not 521-bit.
> 
> Can you elaborate on why this is of primary importance?  If a 521-bit
> curve is as performant, what would cause you to reject it?
> 
> 
> The performance advantages only exist for a 64 bit machine. Anyone building a dedicated crypto processor would probably choose either 256 bits or 512 bits for the internal bus size. The successor to DDR4 will almost certainly be a 512 bit I/O bus width.

All desktops, laptops and most newer phones are 64-bit. Than trend is not going to reverse itself. Dedicated crypto hardware is a very specialized applications Most crypto is done on general-purpose hardware (hoping not to get into the discussion of whether an Intel CPU with an AES unit is specialized or general-purpose)

I don’t think we should sacrifice the performance of the devices we all use for surfing the net for specialized applications like smartObjects or military grade hardware.

Yoav