Re: [Cfrg] Hardware requirements for elliptic curves

[Andy Lutomirski <[e-mail]>]

On Thu, Sep 4, 2014 at 10:44 AM, Alyssa Rowan <[e-mail]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 04/09/2014 13:55, Johannes Merkle wrote:
>
>>> I agree with Alyssa that hardware performance isn’t our concern
>>> here.
>> I disagree with this oversimplification.
>
> Mm, I do think that's an oversimplification. Let me clarify.
>
> I don't think hardware performance should be _completely_ disregarded
> - - merely that it shouldn't be a _primary_ consideration for us (as it
> clearly is, for - for example - NIST & NSA, due to their own needs).
>
> • The vast majority of users overall use software crypto
>   implementations. That will probably continue, although the exact
>   proportion may change. (Heartbleed may indeed encourage increased HSM
>   adoption.)
>
> • Many 'hardware crypto' implementations (HSMs/smartcards/etc) I've
>   seen myself more closely resemble, or literally are, microcontrollers/
>   microprocessors running highly specialist firmware. This approach has
>   several advantages: much greater algorithmic agility versus "glacial"
>   hardware cycles via firmware updates; the ability for more
>   comprehensive side-channel protection; the potential for
>   'correctness' proofs of the software, etc.
>

To add to this point, I expect that we'll see a lot more adoption of
hardware-protected software crypto in the relatively near future.
This could involve tricks like using TrustZone on phones (not
open-source friendly, essentially unauditable, and inflexible) or
virtual tokens using Intel SGX (IMO a vastly superior solution).

For this type of hardware-protected security, the performance
considerations will be almost exactly the same as for software crypto.

--Andy