Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Dan Brown <[e-mail]>]

I revise my vote due to the chairs' clarifications:

Short term: {192=no,256=no} so that IRTF can recommend Curve25519 within an
IETF timeframe.
Long term: {192=yes,256=yes} so that IRTF can recommend curves that try to
minimize risks of ECC.  

Also, I think the chairs have clarified well enough that they were asking
the short term question, so my vote becomes (no,no).

Regarding what's 192, I note NIST/SEC2 recommended a 409-bit binary for 192,
so 414 is not too far off that precedent.

Regarding using non-EC DH groups instead of larger EC groups, that seems to
introduce some rather new risks, albeit perhaps with efficiency gains,
without solving the risk due to Shor's algorithm.  So, I disagree: I think
yet more security can be squeezed out of ECC.

> -----Original Message-----
> From: Dan Brown
> Sent: Tuesday, February 10, 2015 7:36 AM
> Yes + yes.
> 
> clarification: curve _providing at least_ security level x. eg 521 for
512.
> 
> main reason: margin of error
>