Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Tony Arcieri <[e-mail]>]

On Tue, Feb 10, 2015 at 8:57 AM, Yoav Nir <[e-mail]> wrote:

> To the point, there may be a reason for recommending 2^448-2^224-1 or
> 2^414-17, and there may be a reason for recommending 2^521-1. I don’t see a
> reason for aiming at 2^192, finding something close and declaring that as
> “good enough”. I’m not at all convinced that there is a likely scenario
> where it the foreseeable future Curve25519 will be easily enough broken
> that  people will lose confidence, but the mysterious 192-bit one will
> still be considered secure.


I agree with this entire sentiment. It's difficult to envision a scenario
where a 192-bit curve will be broken, but a 256-bit one will not.

For high security curves, I think we should pick primes that offer the best
performance/security tradeoffs, not necessarily ones that are closest to
192-bits or 256-bits.

2^448-2^224-1 is quite promising in this regard, but provides a security
level that lies between 192-bit and 256-bit

-- 
Tony Arcieri