[Cfrg] Goldilocks (was Re: EC - next steps to get draft-irtf-cfrg-curves done)

[Watson Ladd <[e-mail]>]

On Feb 10, 2015 1:23 PM, "Paterson, Kenny" <[e-mail]> wrote:
>
> Hi,
>
> On 10/02/2015 18:33, "Watson Ladd" <[e-mail]> wrote:
>
> >
> >On Feb 10, 2015 9:42 AM, "Stephen Farrell" <[e-mail]>
> >wrote:
> >>
> >>
> >> Thanks to the chairs for trying this approach. I've answered
> >> your first poll, but I'd also like to say that I'm entirely
> >> fine if the chairs use their judgement to evaluate poll responses
> >> and I hope you do not limit yourselves to purely mechanical
> >> evaluations. That's because it's inevitable that people will
> >> question the questions, as has happened already;-) And we
> >> don't want to have to re-do a bunch of polls I hope.
> >I'm surprised that you consider implicitly rejecting 2^448-2^224-1 for
> >unstated arguments a good idea, given your openness to supporting it.
>
> Thanks for making explicit what was implicit.
>
> Yes, we are ruling out 2^448-2^224-1 and focussing on primes yielding
> curves at or near the 192 and 256 bit security levels. There was a long
> discussion on this on the list a while back, no clear consensus emerged on
> whether we should "stick" to the 192-bit and/or 256-bit security levels or
> go for "intermediate" values, and the chairs are now making a decision on
> this.

This strikes me as extremely premature. We do not yet have hard
performance data on 32 bit machines for 2^389-21. In fact, the best
fractional radix I could come up with used exactly the same number of
limbs as the Karatsuba revisited paper uses for 2^414-17, and exactly
the same number of limbs as Goldilocks does: until we actually measure
on actual silicon highly optimized assembly optimizations (something I
can't write: I should learn someday) we don't know which prime is
better.

Of course, if you don't actually care about smartphone performance,
but only the latest and greatest Intel chips, then Goldilocks incurs a
7-8% performance penalty compared to 2^389-21. And if you don't care
about performance, but want the most secure curve possible. Goldilocks
is much smaller than 521. But each of these rationales also excludes
one of the options in the consensus poll!

Far more likely is that people who care about performance agree to eat
a 7% performance hit, and people who want maximum security absorb a
factor of 2^64 in group size, so we have stronger support for
Goldilocks than either of the two extremes. But that's not currently
an option on the poll, and it's not clear what the reason for
excluding it is, other than "448 isn't 384 or 512".

Sincerely,
Watson Ladd

<snip>
>
> Kenny
>
<snip>
> >Sincerely,
> >Watson Ladd
>