Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

[Derek Atkins <[e-mail]>]

Phillip Hallam-Baker <[e-mail]> writes:

> Do we have figures for performance of these versus RSA2048?

Why are you looking at RSA 2048?  That's only a 2^112 work factor
(C.f. Section 1 of RFC4492).  If you want a 2^256 work factor you need
to go up to RSA 15360.  If you only want to get to 2^128 then you need
to look at RSA 3072.  Let's at least compare apples to apples.

> Yes, we get a reversal of the public/private speed advantage on signature. And
> that in itself is a huge win on the server side 
>
> RSA signature verification takes 0.16 ms on a reasonably current machine
> (signature is 6ms)
>
> http://www.cryptopp.com/benchmarks.html
>
> How much faster/slower one curve is over another matters much less to me than
> whether the curve is faster or slower than what I am already using. I am not
> going to be using P521 or P448 curves on a constrained device, I will go for
> P255.
>
> If we had figures comparing the curve candidates to RSA it would probably be
> illuminating.

For the record, I have no opinion on which curves to look at; I would
want to find the best "bang-for-the-buck" curve in terms of performance
and security.  And if 521 is better than 512 in terms of performance I
don't see the extra 9 bits of data as being a deployment issue.

-derek

-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant