Re: [Cfrg] Elliptic Curves - curve form and coordinate systems (ends on March 12th)

[Andrey Jivsov <[e-mail]>]

On 03/12/2015 05:21 PM, Michael Hamburg wrote:
>
>> On Mar 12, 2015, at 3:06 PM, Andrey Jivsov <[e-mail] 
>> <mailto:[e-mail]>> wrote:
>> I wonder how many trees will die due to everybody decompressing the v 
>> for the life of each certificate :-) ?
>
> Sending data over LTE costs 328-615 microjoules per bit [1], 
> presumably mostly on the base station.  Split the middle on that, and 
> figure an extra 256 bits takes 0.12 joules.
>
> [1] 
> http://www.theatlantic.com/technology/archive/2013/04/cell-networks-are-energy-hogs/274961/
>
> 802.11n takes a couple orders of magnitude less energy, so that would 
> be a millijoule.
>
> A Curve25519 point decompression taking 30 microseconds on a 2-watt 
> cell phone processor would take 60 microjoules.  An Ed448-Goldilocks 
> point decompression taking 16 microseconds on a 30-watt server core is 
> half a millijoule.
>
> Remind me how compression takes more energy?

That's interesting about LTE. I was viewing it from the need to buy more 
servers and saving battery life of mobile devices -- computational heat, 
but your are right about some cost of transmitting the bytes.


I assume that decompression means a square root F(p), which is ~ 10% of 
scalar mult.

X.509 verifiers must pay 10% more computational cost to decompress, 
while not every public key is transmitted. An implementation could cache 
a decompressed public key of a sub-CA but this is an additional 
(external to crypto) complexity for 10% saving.

It seems to me that public key crypto offers the worst possible tradeoff 
between computation cost / space efficiency. For lower-hanging fruits 
please consider: TLS removing compression of the record layer, a TLS 
record padding proposal for 1.3 against traffic analysis (up to ~16K), 
an average X.509 certificate ~1K, TLS handshake size at about 4K, and 
the benefits of TLS session reuse / Session ticket.

I am not against compression. It makes sense e.g. when an SMIME message 
is encrypted to multiple recipients, but then again did users care about 
this for larger RSA keys?