Re: [Cfrg] When's the decision?

"Parkinson, Sean" <> Thu, 09 October 2014 07:24 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 8DE451A9127 for <>; Thu, 9 Oct 2014 00:24:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.301
X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id athJsXZJliPs for <>; Thu, 9 Oct 2014 00:24:03 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id E98801A0029 for <>; Thu, 9 Oct 2014 00:24:02 -0700 (PDT)
Received: from ( []) by (Sentrion-MTA-4.3.0/Sentrion-MTA-4.3.0) with ESMTP id s997NuBO010787 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 9 Oct 2014 03:23:57 -0400
X-DKIM: OpenDKIM Filter v2.4.3 s997NuBO010787
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed;; s=jan2013; t=1412839437; bh=FYGh7TtNnVi3v4Eo7RWi1fEA9Yo=; h=From:To:CC:Date:Subject:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=jW7BoYjOK+Sd0jew2Pdj2/prS9D1tKkYkxdBjheKx1HlhvCfyz4/St5m7aXp+E8GB GN5FQ/9A5MXSb1Ww/wEWMJ0t/TeZgJUvlMjMN1XjWKMmJWeY/ltHLMEOsljzpFUAgy CGqmb5dm6FsD1rmBjlSAkr65O0XvnGi7f3QYbyqo=
X-DKIM: OpenDKIM Filter v2.4.3 s997NuBO010787
Received: from ( []) by (RSA Interceptor); Thu, 9 Oct 2014 03:23:03 -0400
Received: from ( []) by (Sentrion-MTA-4.3.0/Sentrion-MTA-4.3.0) with ESMTP id s997NOKH027018 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 9 Oct 2014 03:23:24 -0400
Received: from ([]) by ([]) with mapi; Thu, 9 Oct 2014 03:23:23 -0400
From: "Parkinson, Sean" <>
To: Phillip Hallam-Baker <>
Date: Thu, 9 Oct 2014 03:23:22 -0400
Thread-Topic: [Cfrg] When's the decision?
Thread-Index: Ac/jgMbiloImE2+hTne/4dJE9fpW6gAEQQ/w
Message-ID: <>
References: <> <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-RSA-Classifications: public
Cc: "" <>
Subject: Re: [Cfrg] When's the decision?
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 09 Oct 2014 07:24:13 -0000

I can agree that stepping just over a power of 2 is only going to hurt performance in the future.

Sean Parkinson | Consultant Software Engineer | RSA, The Security Division of EMC
Office +61 7 3032 5232 | Fax +61 7 3032 5299

-----Original Message-----
From: [] On Behalf Of Phillip Hallam-Baker
Sent: Thursday, 9 October 2014 3:21 PM
To: Mike Hamburg
Cc: Parkinson, Sean; Watson Ladd;
Subject: Re: [Cfrg] When's the decision?

On Wed, Oct 8, 2014 at 11:42 PM, Mike Hamburg <> wrote:

> This is basically the point of Ed448-Goldilocks.  It's received a 
> mixed response in this forum, since some people would prefer the most 
> constrained curve, for some definition of "constrained" which doesn't 
> consider performance.

I am happy to consider performance but only if the differences are large and consistent.

This is not a competition where more is better. I don't want more than exactly one high strength curve and exactly one exceptionally high curve. I don't want to see any options or parameters either. Either we are all doing the twist again or nobody is. Either we are all doing compression or not.

And if there isn't a clear basis for a decision we can throw darts.

Some performance issues are show stoppers. Anything that is not less than a clean multiple of a power of 2 is going to cause severe performance hits on future architectures. 512 bit memory buses are common in graphics cards, 521 bit buses are not.

If ED448 is twice as fast as the exactly 512 bit curve then there is a decisive performance advantage. Anything less than 20% is noise.

The point is elimination, to vote people off the island so we can have a winner, not to get more people in.