Re: [Cfrg] What constitutes a curve with a 256-bit security level?

Watson Ladd <watsonbladd@gmail.com> Wed, 18 February 2015 22:45 UTC

MIME-Version: 1.0
In-Reply-To: <CAHOTMVJiOT2+jytVkw626VZUjpbuN76Qgf5J5B61L8uXtAY0-w@mail.gmail.com>
References: <CAHOTMVJKqMcddZ0DEdgh7gVedFR5TPfZHZaVNVmMMUnvTfpLzA@mail.gmail.com> <E64DFFE5-92AE-40EF-8B9D-BD8DA57F0D31@shiftleft.org> <CAHOTMVKSQHSP_=_VreCbXhdE+jkLBq8qJ9S_hquwQEoofB5c4g@mail.gmail.com> <A5B5FC81-DBA3-4FC1-9DFB-FA3D5AD575BD@shiftleft.org> <CAHOTMVJiOT2+jytVkw626VZUjpbuN76Qgf5J5B61L8uXtAY0-w@mail.gmail.com>
Date: Wed, 18 Feb 2015 14:45:42 -0800
Message-ID: <CACsn0cmpntED6T9X+Fh=8OwdcwXPnckeGh3dPJZmvuusdDNazQ@mail.gmail.com>
From: Watson Ladd <watsonbladd@gmail.com>
To: Tony Arcieri <bascule@gmail.com>
Content-Type: multipart/alternative; boundary="001a11395df4492b70050f64949e"
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/cePvw2hh92Df1hQ8VZoNGVG0hAY>
Cc: cfrg@irtf.org
Subject: Re: [Cfrg] What constitutes a curve with a 256-bit security level?
Precedence: list

On Feb 18, 2015 2:39 PM, "Tony Arcieri" <bascule@gmail.com> wrote:
>
> On Wed, Feb 18, 2015 at 2:14 PM, Michael Hamburg <mike@shiftleft.org>
wrote:
>>
>> It may be that you’re thinking SHA512-and-truncate won’t be uniform
enough mod the order of Ridinghood.  But in fact it will, because the order
of Ridinghood is 2^480 - O(2^240), and so the deviation from uniformity
will be O(2^-(240+32)).  The same would not be true for a prime with a
large coefficient like NIST P-256.
>
>
> Okay, my mistake, but that is an issue for E-521, right?

Not really. While the naïve approach if using a single hash function output
of double length for deterministic signing won't work, hashing an
incrementing counter with the message and private key, or some other
variant will.

Sincerely,
Watson Ladd

>
> --
> Tony Arcieri
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
>

[Cfrg] What constitutes a curve with a 256-bit se… Tony Arcieri
Re: [Cfrg] What constitutes a curve with a 256-bi… Michael Hamburg
Re: [Cfrg] What constitutes a curve with a 256-bi… Tony Arcieri
Re: [Cfrg] What constitutes a curve with a 256-bi… Michael Hamburg
Re: [Cfrg] What constitutes a curve with a 256-bi… Tony Arcieri
Re: [Cfrg] What constitutes a curve with a 256-bi… Watson Ladd
Re: [Cfrg] What constitutes a curve with a 256-bi… Tony Arcieri
Re: [Cfrg] What constitutes a curve with a 256-bi… David Jacobson
Re: [Cfrg] What constitutes a curve with a 256-bi… Mike Hamburg