Re: [Cfrg] Minimum required work force for additional curve

[Simon Josefsson <[e-mail]>]

Kurt Roeckx <[e-mail]> writes:

> Since I think this hasn't been clearly asked and that it might
> explain the answer on the other questions asked, I'm guess I'll
> just ask it myself:
>
> Assuming other than the 128 WF curve we only add 1 other curve,
> what is the minimum WF it should have?

I believe the focus on power-of-two work factor comparisons for
asymmetric schemes is harmful.  It makes people jump to the conclusion
that asymmetric schemes share the commonly-believed property that
symmetric schemes have: that adding another bit in the key space doubles
the work factor.  This focus also leads to confusing "algorithm pairing"
ideas.

The concept of work factor is useful though.  I don't see how humans
will ever do > 2^100 operations using today's non-quantum-technology.
Thus, to me, a work-factor of 2^100 is sufficient to address our needs.
And at that level, I would prefer having multiple options.

I could live with recommending Curve25519 and some significantly larger
curve like Ed448-Goldilocks if we can't get consensus on anything more
reasonable (like two curves at 2^100-2^130 work factor), but it will
lead to wasting energy computing the Ed448 operations where cheaper
(energy-wise) alternatives would suffice.

If we want significantly stronger alternatives to >~2^100 work factor
solutions, I would prefer recommending solutions that withstand quantum
technology attackers -- I believe there are solutions in that space.

/Simon

> I'm proposing the following answers, each time 16 bit more:
> 144
> 160
> 176
> 192
> 208
> 224
> 240
> 256
>
>
> Kurt