Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Feb 10, 2015 at 12:39 PM, Stephen Farrell <[e-mail]
> wrote:

>
>
> On 10/02/15 10:52, Alexey Melnikov wrote:
> > CFRG chairs are starting a poll, containing 2 initial questions:
> >
> > Q1: Should CFRG recommend a curve at the 192-bit security level?
>
> Not interesting.
>
> >
> > Q2: Should CFRG recommend a curve at the 256-bit security level?
>
> Yes, approximately.
>
> I would also be fine if there were compelling performance reasons
> for one strength that is in between, e.g. 2^414-17 or similar, but
> I would like only one strength level in addition to ~128-bit.
>
> I'm not that convinced that anything more than the 128-bit level
> is needed, but I believe it will be demanded regardless so having
> just one such specified is better than a zoo of higher strength
> curves.
>

One of the reasons I really want a curve above 128 bit / Curve 25519 is
precisely to clean up the zoo. And for that to happen there has to be a
clear advantage of the new curve over ECC384 which is what we  (and I
suspect most other CAs who do ECC) support today.

And by clear advantage I mean, can be explained over the phone in as short
as time as possible. This has to be a complete no-brainer upgrade.


It isn't just a matter of not being interested in the 192 bit curve, I want
to phase out that strength.

It is important that we have a back up algorithm that can be more or less
relied on to provide a ten year cushion in the case that Curve 25519 is
broken. But we don't need that cushion to be particularly efficient.


On Tue, Feb 10, 2015 at 12:46 PM, Daniel Kahn Gillmor <[e-mail]
> wrote:

> On Tue 2015-02-10 09:20:59 -0500, Stanislav V. Smyshlyaev wrote:
> > Q1: No.
> > Q2: Yes.
> >
> > For Q2: for Russia it is of primary importance that the curve is strictly
> > 512-bit, not 521-bit.
>
> Can you elaborate on why this is of primary importance?  If a 521-bit
> curve is as performant, what would cause you to reject it?



The performance advantages only exist for a 64 bit machine. Anyone building
a dedicated crypto processor would probably choose either 256 bits or 512
bits for the internal bus size. The successor to DDR4 will almost certainly
be a 512 bit I/O bus width.

If you are working at the silicon level then 521 bits is a lot harder to
manage than 512. Those extra 9 bits really do make a huge difference.

Going from 256 bits to 255 is not a big deal. But going above 512 makes
things really painful.