Re: [Cfrg] Minimum required work force for additional curve

Simon Josefsson <> Mon, 02 March 2015 11:26 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 778311A8715 for <>; Mon, 2 Mar 2015 03:26:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.348
X-Spam-Status: No, score=0.348 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HELO_EQ_SE=0.35, SPF_PASS=-0.001] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id gfbJUsxOhIVi for <>; Mon, 2 Mar 2015 03:26:04 -0800 (PST)
Received: from ( [IPv6:2001:9b0:1:1702::100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 7444E1A8725 for <>; Mon, 2 Mar 2015 03:26:00 -0800 (PST)
Received: from ([IPv6:2001:16d8:cca1:0:1db3:13ed:7278:5ac4]) (authenticated bits=0) by (8.14.4/8.14.4/Debian-4) with ESMTP id t22BPuge030718 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=NOT); Mon, 2 Mar 2015 12:25:57 +0100
From: Simon Josefsson <>
To: Kurt Roeckx <>
References: <>
OpenPGP: id=54265E8C; url=
Date: Mon, 02 Mar 2015 12:25:55 +0100
In-Reply-To: <> (Kurt Roeckx's message of "Thu, 26 Feb 2015 20:03:33 +0100")
Message-ID: <>
User-Agent: Gnus/5.130012 (Ma Gnus v0.12) Emacs/24.4 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
X-Virus-Scanned: clamav-milter 0.98.6 at
X-Virus-Status: Clean
Archived-At: <>
Subject: Re: [Cfrg] Minimum required work force for additional curve
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 02 Mar 2015 11:26:05 -0000

Kurt Roeckx <> writes:

> Since I think this hasn't been clearly asked and that it might
> explain the answer on the other questions asked, I'm guess I'll
> just ask it myself:
> Assuming other than the 128 WF curve we only add 1 other curve,
> what is the minimum WF it should have?

I believe the focus on power-of-two work factor comparisons for
asymmetric schemes is harmful.  It makes people jump to the conclusion
that asymmetric schemes share the commonly-believed property that
symmetric schemes have: that adding another bit in the key space doubles
the work factor.  This focus also leads to confusing "algorithm pairing"

The concept of work factor is useful though.  I don't see how humans
will ever do > 2^100 operations using today's non-quantum-technology.
Thus, to me, a work-factor of 2^100 is sufficient to address our needs.
And at that level, I would prefer having multiple options.

I could live with recommending Curve25519 and some significantly larger
curve like Ed448-Goldilocks if we can't get consensus on anything more
reasonable (like two curves at 2^100-2^130 work factor), but it will
lead to wasting energy computing the Ed448 operations where cheaper
(energy-wise) alternatives would suffice.

If we want significantly stronger alternatives to >~2^100 work factor
solutions, I would prefer recommending solutions that withstand quantum
technology attackers -- I believe there are solutions in that space.


> I'm proposing the following answers, each time 16 bit more:
> 144
> 160
> 176
> 192
> 208
> 224
> 240
> 256
> Kurt