Re: [Cfrg] A big, big Elliptic Curve

[Stephen Farrell <[e-mail]>]

On 10/04/16 18:31, Ilari Liusvaara wrote:
> My interpretation of NSA position & announcements is:
> - QC is coming sufficently soon (and here "soon" can mean 30 years or
>   so) that there is no point in transitioning to ECC anymore.
> - NSA thinks that multiplicative-DH is significantly harder than what
>   "open literature" considers.
> 

That seems like a reasonable interpretation if one takes what
they say at face value.

I'm not comfortable doing that to be honest. I remain concerned
that a part of this could be an attempt to discourage deployment
of current crypto by focusing attention on the next shiny thing
(pq crypto).

I do think we should be doing preparatory work on pq crypto,
but I am frankly uneasy to see people seemingly believing what
the NSA assert with no real evidence offered. These after all
are the same people (or indistinguishable from the people) who
were happy to try pull a fast one on another part of their own
government (I mean NIST/dual-ec).

I think the very least they need to do is to offer evidence if
they expect to be believed about anything non-obvious.

The solution to this quandry I think is for us to base decisions
on whatever openly available evidence we have, but on nothing else.
(So we ought not IMO factor in press-releases from anyone.)

And yes, if we don't have that evidence, that does create a
danger that we ignore qc risks more than we ought. The blame for
that however lies clearly with those who muddied the waters.

Cheers,
S.