Re: [Cfrg] Task looming over the CFRG

[David McGrew <[e-mail]>]

Hi Michael,

On 05/05/2014 02:25 PM, Michael Hamburg wrote:
> Hi Kevin,
>
> As the designer of an ECC system which is aimed at 224-ish-bit 
> security, I'm curious: is it a firm requirement that the curves be set 
> at 128, 192 and 256 bits?

Eric Rescorla suggested that CFRG recommend a single family of curves, 
as opposed to recommending multiple curves at each security level.   The 
security levels that you mention were his examples, and are good ones in 
my opinion.   But there was no explicit discussion of whether or not 
there should be curves at other security levels.

David

> Or was there consensus in the meeting that the curves should be set at 
> these security levels?  Patrick Longa aimed his talk at these security 
> levels, but I don't recall this being stated as a requirement.
>
> Cheers,
> --- Mike
>
>
> On May 5, 2014, at 10:58 AM, Igoe, Kevin M. <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>> As most the folks who read this list have noticed, a virtual interim 
>> meeting of the CFRG
>> was held on Tues 29 April to discuss the way forward for elliptic 
>> curve cryptography
>> in the IETF. */This/**/was/**/driven by an earnest plea from the TLS 
>> WG for firm/**//**/guidance/**/from
>> the CGRG/**/on the selection of elliptic curves/**//**/for use in 
>> TLS.  They need an answer/**/before
>> /**/the/**/Toronto/**/IETF meeting i/**/n/**//**/late July/*.  TLS 
>> needs curves for several*//*levels of security (128,
>> 192 and 256), suitable for use in both key agreement and*//*in 
>> digital signatures.
>>
>>   * The consensus of the attendees was that it would be best for TLS
>>     to have a single
>>     "mandatory to implement" curve for each of the three security levels.
>>
>>   * Though the attendees were reluctant to make a formal commitment,
>>     there
>>     was clearly a great deal of support for the Montgomery curve
>>     curve25519 (FYI, the
>>     25519 refers to the fact that arithmetic is done modulo the prime
>>     2**255 -- 19 ).
>>
>>   * curve25519 only fills one of the three required security levels. 
>>     We still need
>>     curves of size near 384 bits and 512 bits.
>>
>>   * NIST curves: I doubt TLS will be willing to revisit the question
>>     of elliptic curves once the
>>     CFRG has made their recommendation.  Another option to consider
>>     is advising TLS to
>>     use of the NIST curves in the short term, buying time for the
>>     CFRG to do an unrushed
>>     exploration of the alternatives, drawing academia and other
>>     standards bodies into the
>>     discussion.
>>
>> P.S.  It has been suggested that the CFRG hold a session at the 
>> Crypto conference in
>> Santa Barbara in an effort to draw in more participation from the 
>> academic community.
>> No guarantees we can pull this off, but it is worth the attempt. 
>> Thoughts? Volunteers?
>> P.P.S. We need to start lining up speakers for the CFRG session at 
>> IETF-90 (Toronto).
>> ----------------+--------------------------------------------------
>> Kevin M. Igoe   | "We can't solve problems by using the same kind
>> [e-mail] <mailto:[e-mail]> | of thinking we used when we 
>> created them."
>> |              - Albert Einstein -
>> ----------------+--------------------------------------------------
>> _______________________________________________
>> Cfrg mailing list
>> [e-mail] <mailto:[e-mail]>
>> http://www.irtf.org/mailman/listinfo/cfrg
>
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg