Re: [Cfrg] Requirements for curve candidate evaluation update

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Aug 14, 2014 at 10:31 PM, Tanja Lange <[e-mail]> wrote:
>>    4. The security levels are 128, 192, and 256 bits and each curve will only
>>    be evaluated at one of those levels.
>>
> You Keep Using That Word, I Do Not Think It Means What You Think It Means.
>
> Seriously, define for me n-bit security level.

Well its easy enough to define work factor according to best known attack.

Only we need some security margin and we probably need to round up so
that we can defend the choice to folk who are not experts without
getting into citing specific papers.

So if the work factor isn't a 1:1 exponent of the key size or very
close, one way is we round up to the next integer.

AES-128 has a work factor of 2^128
AES-256 has a work factor of 2^256

A 128 bit modulus curve does not have a 128 bit work factor, its less.
but it is greater than 64 bits which is 128/2.

Now obviously the case can be made that a 448 bit modulus gives a work
factor greater than 2^256. But it requires a PhD to understand it. And
that is not a case I want to have to make to lay-people who think
everyone secretly works for the NSA.