[Cfrg] The 512/521 thing Re: Elliptic Curves - poll on security levels (ends on February 17th)

Phillip Hallam-Baker <phill@hallambaker.com> Tue, 10 February 2015 23:43 UTC

MIME-Version: 1.0
Sender: hallam@gmail.com
Date: Tue, 10 Feb 2015 18:43:00 -0500
Message-ID: <CAMm+LwjqwVh9r3uZB8XUVPnJStTi8t7Lvj8fm48kP=T_cwbJGA@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
To: Станислав Смышляев <smyshsv@gmail.com>
Content-Type: multipart/alternative; boundary="001a1133ac527edec2050ec472ab"
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/Zl31USbPzcdC0kE84V3t5iiSTh8>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: [Cfrg] The 512/521 thing Re: Elliptic Curves - poll on security levels (ends on February 17th)
Precedence: list

On Tue, Feb 10, 2015 at 2:15 PM, Станислав Смышляев <smyshsv@gmail.com>
wrote:

> Dear Daniel,
>
> the Russian digital signature standard strictly requires that the order of
> the prime subgroup of a curve either lies between 2^(254) and 2^(256) or
> lies between 2^(508) and 2^(512) - and one won't generate a curve with a
> cofactor of 512 (=2^(521-512)).

The only way I can see someone coming up with that requirement is by first
deciding that Curve 25519 is close enough to 256 to not be worth worrying
about the extra bit and then writing the bill so that it works for that
specific special case without either making it look like it is a special
case or opening the door to lots of other special cases.

I don't want to get into making allowances for special crypto for any
governments. Do it for one and we end up having to do it for 200.

But we are in a position where what we really need are rejection criteria.
Arbitrary objective criteria make reaching a decision easier than
subjective not very sharp criteria.

[Cfrg] The 512/521 thing Re: Elliptic Curves - po… Phillip Hallam-Baker
Re: [Cfrg] The 512/521 thing Re: Elliptic Curves … Stanislav V. Smyshlyaev