Re: [Cfrg] ECC reboot (Was: When's the decision?)

["Lochter, Manfred" <[e-mail]>]

>
> If you wanted another Brainpool: why, and what is stopping Brainpool from
> doing it? You didn't need to do it here before. You seem to be worried the
> BADA55 paper discredits the Brainpool curves by showing a plausible way
> they could have been rigged. It doesn't prove that they actually were
> rigged (indeed, Brainpool is listed on Safecurves as "somewhat rigid" and
> still has a tick in that box). Where's the fire?

For examle here:
Andy Lutomirski wrote on 16.10.2014 20:06:
> Are the Brainpool curves really VPR?  They're certainly far better in
> that regard than the NIST curves, but the BADA55 paper points out
> correctly that the "verifiably" part is weak.

And for me the reasoning from the BADA55 paper does not appear to be 
plausible.


>
> I'm relatively new, but my understanding is that Stephen is correctly
> pointing out that mandatory-to-implement anything is way out-of-scope here.
> We make suggestions, recommendations; downstream WGs in IETF decide whether
> they have rough consensus to adopt them, and then implementers decide
> whether they actually care to.

Where did I suggest to make anything mandatory? I searched all my postings 
for "mandatory" without finding that source.

> >As the cfrg  also discusses parameter lengths I would like to add that it
> > is completely adequate to use 384 bit curves even for highest security
> > demands.
>
> I agree, although there aren't any convenient special primes around that
> area. (I also think 256 is fine.)
>
> >So, 384 bit curves must be included in any proposed set of curves.
>
> Um, how does that follow? Do you propose just 256 and 384, then? Or...?
>
> Why is 384-bit a must? What's so magical about it? Why not 417? 448? 512?
> 521? 607? 31337?

You can see this statement as a direct answer to your own posting from 
September 14, where you stated "If it's optional, I definitely say drop 192 
from requirement SE6". There you did not write about 31337, did you?

To make it perfectly clear: If the group is going to only propose curves for 
two security-levels I'm opting for 128 and 192. 

Manfred



-- 
Lochter, Manfred
--------------------------------------------
Bundesamt für Sicherheit in der Informationstechnik (BSI)
Referat K21
Godesberger Allee 185 -189
53175 Bonn

Postfach 20 03 63
53133 Bonn

Telefon: [phone] 5643
Telefax: [phone] 5643
E-Mail: [e-mail]
Internet:
www.bsi.bund.de
www.bsi-fuer-buerger.de