[Cfrg] Actual security levels for IETF crypto

["D. J. Bernstein" <[e-mail]>]

CFRG's stated goal in the curve-selection process is to "provide real
value" not just to TLS but "the IETF more widely". As an illustration of
how crypto is in fact used in other IETF protocols, here are the three
most common security levels chosen by top-level domains that use DNSSEC:

    ~80-bit security (1024-bit RSA): 286 TLDs.
    ~90-bit security (1280-bit RSA): 192 TLDs.
   ~110-bit security (2048-bit RSA):  22 TLDs.

The fastest-growing category is ~90-bit security (1280-bit RSA). I don't
see how this fits the "marketing department needs powers of 2" theory. I
do see how it fits the "users are choosing weak crypto for performance
reasons" theory.

---Dan