Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

[Rene Struik <[e-mail]>]

Hi Alexey:

Order of preference:
a) curve with 64-byte underlying prime field
b) curve with 521-bit underlying prime field (due to P-521 precedent 
with Mersenne primes)

Notes:
1) This curve is supposed to serve as a really conservative pick, so I 
think curves below the 500-bit demarcation line curves, no matter their 
charm, should be out.
2) Picking a curve with prime order subgroup of 508-512 bit would 
satisfy Russian parameter requirements, so if we could accommodate this 
and show inclusiveness, so much the better (this would be sign of 
strength for this group).
-- Examples: Microsoft's 512-bit nums curve, M-511 (IACR ePrint 
2013-647) {not clear (to me) what design criteria were to include field 
bit-sizes in the poll below, since neither 511/512 mentioned.}
3) Slight performance differentials (say, less than factor 2x) around 
the same design crypto bit strength should not be that important, at 
least not with this really conservative pick (I do expect 128-bit design 
strength curves to be used with, e.g., signing DH exponents, where there 
may be some roots that use the conservative pick).

Best regards, Rene

On 2/25/2015 9:27 AM, Alexey Melnikov wrote:
> CFRG chairs are starting another poll:
>
> Q3: This is a Quaker poll (please answer one of "preferred", 
> "acceptable" or "no") for each curve specified below:
>
> 1) 448 (Goldilocks)
> 2) 480
> 3) 521
> 4) other curve (please name another curve that you "prefer" or 
> "accept", or state "no")
>
> If you stated your curve preferences in the poll that ended on 
> February 23rd (see the attachment), you don't need to reply to this 
> poll, your opinion is already recorded. But please double check what 
> chairs recorded (see the attachment).
>
> If you changed your mind or only answered the question about 
> performance versa memory usage for curves 512 and 521, feel free to 
> reply.
>
> Once this issues is settled, we will be discussing (in no particular 
> order. Chairs reserve the right to add additional questions) 
> implementation specifics and coordinate systems for Diffie-Hellman. We 
> will then make decisions on signature schemes. Please don't discuss 
> any of these future topics at this time.
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]