Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

["Stanislav V. Smyshlyaev" <[e-mail]>]

Dear Daniel,

there is a draft of the new Russian digital signature standard GOST R
34.10-2012 in English:
https://tools.ietf.org/html/draft-dolmatov-gost34102012-00. Also the
previous standard (there are only two major differences between standards:
distinct hash functions and available key sizes) is included in ISO/IEC
14888-3:2006/Amd.1:2010(en) Information technology — Security techniques —
Digital signatures with appendix — Part 3: Discrete logarithm based
mechanisms AMENDMENT 1: Elliptic Curve Russian Digital Signature Algorithm,
Schnorr Digital Signature Algorithm, Elliptic Curve Schnorr Digital
Signature Algorithm, and Elliptic Curve Full Schnorr Digital Signature
Algorithm.

If there is a need of any comments to these two documents, I will be glad
to provide them.


Best regards,

Stanislav V. Smyshlyaev, Ph.D.,

Head of Information Security Department,

CryptoPro LLC


2015-02-11 1:49 GMT+03:00 Daniel Kahn Gillmor <[e-mail]>:

> On Tue 2015-02-10 14:15:09 -0500, Станислав Смышляев wrote:
>
> > the Russian digital signature standard strictly requires that the
> > order of the prime subgroup of a curve either lies between 2^(254) and
> > 2^(256) or lies between 2^(508) and 2^(512) - and one won't generate a
> > curve with a cofactor of 512 (=2^(521-512)).
>
> This feels a bit like begging the question to me: without more
> explanation, saying the "Russian digital signature standard strictly
> requires" still seems arbitrary.  Does the Russian digital signature
> standard provide an explicit rationale for the upper bound?
>
> Maybe more detail would be useful:
>
> Will there be systems unable to adopt new recommended curves at that
> security level because of a larger group?  how many?  what sorts of
> systems?  Which Russian digital signature standard exactly?  Can you
> provide a pointer so that people unfamiliar with it can see what the
> constraints are themselves?
>
> How much will the Russian Digital Signature standard need to be updated
> to allow the use of any new curves?  If it needs to be updated anyway,
> could it be also updated to allow 521-bit curves if we manage to get a
> rough consensus from other participants?
>
> By comparison, the NIST folks (from the US gov't) seem open to
> considering new curves in the near future.  Is that flexibility
> something that the agency governing the standards in question can also
> provide?
>
> I think we can take your concerns into better consideration (and we can
> make better decisions as a group) the more details we know about these
> constraints.
>
>         --dkg
>