Re: [Cfrg] Elliptic Curves - poll on specific curve around 256bit work factor (ends on February 23rd)

Q3: Yes.

A little extra uncompressed/compressed prime curve slight above 512
(1024b public key) is negligible cost difference to store and send in
the grand scheme of things.
It is after the end date but I wanted to contribute, at least because
there was no post interpreting the question as a monetary cost for data.
djb's answer in Subject: [Cfrg] network traffic
<20150223032102.23370.qmail@cr.yp.to> was awesome and inspired me to
post these scratchings.
The poll form is cool and I have been enjoying peoples responses.

These are fuzzy Fermi Equations :-) The total number of keys is going to
increase as humans engage in more cryptosystems. 10k xchg wtf? also
machines.

Early 2015.
Yearly key rotation, so cost are per annum and will decrease over time
as rest and transit costs decrease per GB.
Only raw key material considered, not cert or key meta (which is in the
order of kilobytes per key) but is mostly constant between key sizes.

Data at Rest cost per GB SSD:    0.40    $/GB
Data at Rest cost per GB HDD:    0.03    $/GB
Data in Transit cost per GB:    0.04    $/GB
Earth humans:    7000000000    persons
x keys per person    50   
key size    512 bits   
Total keys for people    350000000000   
Bytes to store every humans 50 private keys @ key size EC:   
22400000000000   
Bytes to store every humans 50 public keys (x2) @ key size EC:   
44800000000000   
GB of public keys    41723.25   
GB of private keys    20861.63   
Lifetime Key transfers    10000   
Cost to store on SSD    $16,689.30   
Cost to store on HDD    $1,251.70   
Cost to transmit every key lifetime_transfer_n times    $16,689,300.54   

Now we consume 66 bytes for our private key in secp521r1, but log2(521)
= 65.125 so we are wasting 7 bits we could use
for no additional cost at the data layer.
So our range of primes is for same cost as secp521r1 is 2^528 but I
don’t know of any at this size.

Even a modest 5% key size increase over 512b is going to cost us
something like $800 extra to store on SSD's and
$800,000 to transfer over the life of all the keys per year somewhat
divided up among all players.
Totally worth it in my opinion.

Thanks for reading,
_MiW

On 18/02/2015 9:21 PM, Alexey Melnikov wrote:
> CFRG chairs are starting another poll:
>
> Q3: (For people who want CFRG to recommend a curve at 256bit level) Is 
> bandwidth cost of going to p521 worth the speed win over primes closer 
> to 512 bits?
>
>
> Once this issues is settled, we will be discussing implementation 
> specifics and coordinate systems for Diffie-Hellman. We will then make 
> decisions on signature schemes. Please don't discuss any of these future 
> topics at this time.
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
>