Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Yoav Nir <[e-mail]>]

> 
> If there's no consensus on doing curves at 192-bit and 256-bit security
> level, then the plan would be to abandon work on such curves until after
> we've delivered recommendations to the TLS WG. The chairs' current
> thinking would be to then come back to this later on. (Of course, at that
> point, people might decide that IETF is not the place to put their
> efforts, and that NIST's activity is the place to be. So be it.)

In that case, my vote (and I realize this is a write-in candidate) is to:
 1. Not delay the answer to TLS about Curve25519
 2. Immediately start a (hopefully) short-term process to make a similar recommendation about Goldilocks or other, similar candidates.
 3. Start a long-term process for a next-generation algorithm, perhaps a genus-2 curve, with the property that it is not likely to fail together with Curve25519.

And since write-ins are not really allowed, I’ll just go with my #1 and vote “No” to both.

Yoav