Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

Derek Atkins <derek@ihtfp.com> Wed, 25 February 2015 16:53 UTC

Return-Path: <derek@ihtfp.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F1D81A1A7F for <cfrg@ietfa.amsl.com>; Wed, 25 Feb 2015 08:53:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.289
X-Spam-Level:
X-Spam-Status: No, score=-1.289 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_ORG=0.611] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hA6bqfn3n04R for <cfrg@ietfa.amsl.com>; Wed, 25 Feb 2015 08:53:47 -0800 (PST)
Received: from mail2.ihtfp.org (MAIL2.IHTFP.ORG [204.107.200.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE7921A1A10 for <cfrg@irtf.org>; Wed, 25 Feb 2015 08:53:47 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mail2.ihtfp.org (Postfix) with ESMTP id 98A60E203F; Wed, 25 Feb 2015 11:53:46 -0500 (EST)
Received: from mail2.ihtfp.org ([127.0.0.1]) by localhost (mail2.ihtfp.org [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 30470-05; Wed, 25 Feb 2015 11:53:44 -0500 (EST)
Received: from securerf.ihtfp.org (unknown [IPv6:fe80::ea2a:eaff:fe7d:235]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mocana.ihtfp.org", Issuer "IHTFP Consulting Certification Authority" (verified OK)) by mail2.ihtfp.org (Postfix) with ESMTPS id DC2C7E2039; Wed, 25 Feb 2015 11:53:44 -0500 (EST)
Received: (from warlord@localhost) by securerf.ihtfp.org (8.14.8/8.14.8/Submit) id t1PGrhPo005828; Wed, 25 Feb 2015 11:53:43 -0500
From: Derek Atkins <derek@ihtfp.com>
To: Phillip Hallam-Baker <phill@hallambaker.com>
References: <54EDDBEE.5060904@isode.com> <54EDEE67.1010102@cs.tcd.ie> <CAMm+Lwit7UW3BZUAiariwqqt+0ut6eDVuL9MO7i-_6vwv4kPgA@mail.gmail.com>
Date: Wed, 25 Feb 2015 11:53:42 -0500
In-Reply-To: <CAMm+Lwit7UW3BZUAiariwqqt+0ut6eDVuL9MO7i-_6vwv4kPgA@mail.gmail.com> (Phillip Hallam-Baker's message of "Wed, 25 Feb 2015 11:22:16 -0500")
Message-ID: <sjmzj82vso9.fsf@securerf.ihtfp.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Virus-Scanned: Maia Mailguard 1.0.2a
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/V5-7QuKO-ZCsAQ2zH2bjENXvOic>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Feb 2015 16:53:49 -0000

Phillip Hallam-Baker <phill@hallambaker.com> writes:

> Do we have figures for performance of these versus RSA2048?

Why are you looking at RSA 2048?  That's only a 2^112 work factor
(C.f. Section 1 of RFC4492).  If you want a 2^256 work factor you need
to go up to RSA 15360.  If you only want to get to 2^128 then you need
to look at RSA 3072.  Let's at least compare apples to apples.

> Yes, we get a reversal of the public/private speed advantage on signature. And
> that in itself is a huge win on the server side 
>
> RSA signature verification takes 0.16 ms on a reasonably current machine
> (signature is 6ms)
>
> http://www.cryptopp.com/benchmarks.html
>
> How much faster/slower one curve is over another matters much less to me than
> whether the curve is faster or slower than what I am already using. I am not
> going to be using P521 or P448 curves on a constrained device, I will go for
> P255.
>
> If we had figures comparing the curve candidates to RSA it would probably be
> illuminating.

For the record, I have no opinion on which curves to look at; I would
want to find the best "bang-for-the-buck" curve in terms of performance
and security.  And if 521 is better than 512 in terms of performance I
don't see the extra 9 bits of data as being a deployment issue.

-derek

-- 
       Derek Atkins                 617-623-3745
       derek@ihtfp.com             www.ihtfp.com
       Computer and Internet Security Consultant