Re: [Cfrg] Elliptic Curves - poll on specific curve around 256bit work factor (ends on February 23rd)

[Phillip Hallam-Baker <[e-mail]>]

On Mon, Feb 23, 2015 at 5:17 AM, Simon Josefsson <[e-mail]>
wrote:

> Alexey Melnikov <[e-mail]> writes:
>
> > CFRG chairs are starting another poll:
> >
> > Q3: (For people who want CFRG to recommend a curve at 256bit level) Is
> > bandwidth cost of going to p521 worth the speed win over primes closer
> > to 512 bits?
>
> Yes.  In this case, I believe the performance improvement would be
> significant whereas the bandwidth cost is negligible.  I'm assuming
> compressed code points.
>

I don't recall ever seeing a post suggesting bandwidth was the issue.

The actual issues are:

1) Performance (512 takes X% longer than 521)
2) Rigidity, 512 is a round number, 521 isn't
3) Regulation, (apparently Russia has legislation that effectively forces
512 or 511.)

How you weight these issues depends very much on the value of X. So I am
rather surprised that we didn't agree on a figure for X first. We don't
have to have an exact value but we do need values based on code that has
been optimized to the same degree. I have been watching for those numbers
but have not seen them yet.

If the value of X is definitely less than 10% I think there would be no
debate, 10% isn't enough to justify a strange number.

If the value of X is definitely more than 100% then 521 is the clear winner.


Yes, I know there will be error bars on the numbers because the code will
run at different speeds on different platforms. But lets face it, modern
platforms don't actually vary a whole lot.

A 10% difference in speed might be enough to make an objective choice
between Edwards and Montgomery but only experts know the difference between
those.


In short, I want to see the end of this particuar thread:

http://www.ietf.org/mail-archive/web/cfrg/current/msg05349.html

At the time the code for E512-569 was actually 15% faster than for E521-1


If Microsoft care enough about this that they are willing to put in more
cycles optimizing open source code for their favored outcome than
supporters of E521-1, then I say let them have it.