Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Feb 10, 2015 at 5:52 AM, Alexey Melnikov <[e-mail]>
wrote:

> CFRG chairs are starting a poll, containing 2 initial questions:
>
> Q1: Should CFRG recommend a curve at the 192-bit security level?
>
> Q2: Should CFRG recommend a curve at the 256-bit security level?
>

Q1: No
Q2: Yes

The reason I don't see a need for 192 bit is that I have never seen
significant use of 192 bit AES.

The more complexity we put into the systems, the more opportunity there is
for attack. This is not a choice like RSA or DH where the exact same code
can be used for different bit levels.

The two places we will be using the code is for ephemeral key agreement and
for initial agreement of a master key. Assuming that we fix the TLS key
derivation alg so that a 128 bit ephemeral does not weaken a 256 bit
negotiation, I predict ephemeral will be exclusively Curve 25519 and PKI
will be exclusively Curve~512.


Phill