Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

[Simon Josefsson <[e-mail]>]

I believe the focus on "around 256bit work factor" is distracting and
could better be phrased "alternative to Curve25519 with higher security
margin".  Given that the work factor on the mentioned curves vary quite
significantly away from 256-bit, I'm reading the poll that way.

> Q3: This is a Quaker poll (please answer one of "preferred",
> "acceptable" or "no") for each curve specified below:
>
> 1) 448 (Goldilocks)

Preferred.

> 2) 480

Acceptable.

> 3) 521

Acceptable.

> 4) other curve (please name another curve that you "prefer" or
> "accept", or state "no")

Curve25519       Preferred
E-382            Acceptable
M-383            Acceptable
Curve383187      Acceptable
brainpoolP384t1  No
NIST P-384       No
Curve41417       Acceptable
Ed448-Goldilocks Preferred
M-511            Acceptable
E-521            Acceptable

Generally, any curve that has high performance, reasonable security
(more than ~100 bits of work factor) and doesn't have design warts
(SafeCurves) is acceptable to me.  To become preferred, I select the
curves out of the acceptable curves that is seeing the highest adoption
rate in the implementers community and getting the most reviews in the
cryptographic community.  The former (acceptable) is a simple process,
the latter (preferred) is subjective.

/Simon