[Cfrg] Primes (last time hopefully!)

[Watson Ladd <[e-mail]>]

Dear all,

The following have been suggested for primes at sizes between 2^255-19
and 2^521-1.

2^521-1
2^512-big
2^448-2^224-1
2^414-17
2^389-21
2^384-big
2^379-19

I'm omitting smaller primes from the list, because I don't think that
2^324-24 is that interesting to anyone, for instance, as the time
taken to compute  a discrete log isn't that much bigger than 2^255-19
and the performance not much better then 2^379-19.

Personally I think 2^521-1 needs to be in there, and 2^379-19 is
reasonable, absent hard numbers showing its terrible. I'm hoping
sometime to get those hard numbers.

I'm assuming we use Edwards with the minimal d and the isogenous
Montgomery curve with small value of a24 for all of these: there
doesn't seem to be a reason not to. We can twist if that produces a
complete curve: it's almost completely irrelevant.

Sincerely,
Watson Ladd