Re: [Cfrg] matching AES security

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Aug 1, 2014 at 9:03 AM, Alyssa Rowan <[e-mail]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 1 August 2014 09:53:50 BST, Alex Elsayed <[e-mail]> wrote:
>
>>Matching bit-lengths has value not in the _technicals_, but because it's a Schelling point.
>
> I think recommendations need to be made on solid technical and practical grounds, not fluffy marketing and psychological ones.

Such as?

The problem here is that we don't have solid technical reasons because
we don't know the attacker capabilities. In fact we can't ever know
that.

Yesterday someone claimed in another forum that 'performance' was an
objective factor, as if every algorithm executed as fast (or at least
relatively) on each architecture. The likelihood of a split decision
with algorithm A faster on Intel and B faster on AMD didn't occur to
them.

The needs of marketechture align perfectly with the goal of rigidity.
There is absolutely no way that any of the academics can tell us that
we need exactly 123 or 129 bits. So we stick to round multiples of
128.

Now curve 25519 is not perfectly rigid, but as I pointed out
previously, rigidity is a better argument than performance at the
WF256 level and performance is a better argument than rigidity at the
WF128 level


> Users wouldn't typically know Rho work factor is actually lower than they thought at 0.886√ℓ, or might just think the 521-bit curves just typoed 512. Not to mention the eye-roll I know most of us feel when we see "military-grade" crypto marketed (probably with clearly-visible penguins), and the number of times we've all seen people copy-paste SSL configs.

I never used the term because most military crypto has been crap.
Weekend before last I was watching Daniel Ellsberg in the Chelsea
Manning room talking to Edward Snowden on a video link. None of those
names would have been known if the NSA had been remotely competent.


> We need fast, strong cryptosystems. But I don't think specific aesthetics of the bit lengths of those matter outside their security and performance effects, and I don't think it'll have an appreciable effect on adoption either way.

How many customers have you talked to about crypto?

Most people who use crypto will use the crypto that the CA industry
tells them to use. And we will pick crypto on the basis of arguments
we can explain to our customers.

And that is the way it should be. The choice of Twisted-Montgomery
versus Do-Whap Weinerschnitzel is not something we need to explain
even exists. But they do understand bit lengths even if they don't
understand the implications.


I can make a really solid marketing argument for Curve25519 and I can
make a really solid argument for NUMS-512-569.

To argue for E521 I have to make the case that 'Dan Bernstein told me
he likes it' which is not very convincing to the people who don't know
who he is.