Re: [Cfrg] Elliptic Curves - poll on specific curve around 256bit work factor (ends on February 23rd)

["Paterson, Kenny" <[e-mail]>]

Hi Phillip,

On 20/02/2015 19:50, "Phillip Hallam-Baker" <[e-mail]> wrote:

>
>
>On Fri, Feb 20, 2015 at 1:17 PM, Watson Ladd
><[e-mail]> wrote:
>
>
>On Feb 20, 2015 9:21 AM, "Phillip Hallam-Baker" <[e-mail]>
>wrote:
>
>> Well maybe if we had discussed it first. As it is your poll completely
>>mis-states the reasons people prefer 512 over 521. Which rather
>>undercuts the whole process.
>We've been discussing these issues for nearly a full year. You've had and
>taken ample opportunity to explain why you don't like E-521, and the fact
>that no one else is convinced has a lot to do with the strength of your
>arguments.
>
>
>You are entitled to your opinion but it is far from the case that
>everyone here sees things as you do.
>
>
>Even if my opinion was wrong, the chairs should not misrepresent them.
>

We didn't either present or misrepresent your views. Other people
attributed that to us. We simply asked a question, which I'll repeat here
for your and everyone else's benefit:

Q3: (For people who want CFRG to recommend a curve at 256bit level) Is
bandwidth cost of going to p521 worth the speed win over primes closer
to 512 bits?

No mention of Phillip Hallam-Baker there, as far as I can see.

Let's all try to stay calm, please.

Thanks

Kenny



>
>
>> The way I would do this is as a Quaker poll asking people what their
>>preferred outcome is and what they can live with on 448, 480, 512 and
>>521.
>>
>> 448 - No
>> 480 - Acceptable
>> 512 - Preferred 
>> 521 - No
>>
>> This is meant to be a consensus process and we should be using
>>consensus seeking tools wherever possible. Votes for the best outcome
>>are not the best way to come to consensus.
>No, it's about using our expertise to make the right decision. If your
>arguments are wrong, don't expect us to pay attention.
>
>
>If the issue was expertise in mathematics then it would be a simple
>choice. The question is not down to that type expertise, it is which set
>of criteria are considered to be important. And there experience is
>rather more relevant than expertise in the
> specific branch of math.
>
>
>You think that performance should be the criteria. In the twenty years
>since I was a grad student the performance of computers has doubled every
>18 months or so. I am writing this on a computer that has more computing
>power than the fastest supercomputer
> available only ten years ago, cost less than $10,000 and plugs into a
>regular wall socket.
>
>
>I don't actually care very much about the specific outcome here. What is
>important to me is whether the outcome is backed by 10%, 50% or 90% of
>the industry. And that in turn depends first and foremost on the
>litigation cost associated with the new algorithm
> and next to that the ease with which we can convince people that there
>is nothing odd about the choice.
>
>
>So I am far more concerned about process than outcome here. How long we
>spend arguing is much less important to me than the risk we have to do it
>all again soon. 
>
>
>
>
>The litigation risk has no bearing on 512 or 521 but it is going to have
>a big bearing on the choice of curve. More than one of us is going to
>have to eventually have to explain all of this stuff to lawyers at
>$400/hr per person involved and up. The cost
> of moving to ECC is going to largely depend on the length of time those
>conversations take.
>
>
>