Re: [Cfrg] matching AES security

[Alex Elsayed <[e-mail]>]

On Wednesday, July 30, 2014 12:33:36 PM D. J. Bernstein wrote:
<Snip detailed, informative explanation of why matching security levels is 
nowhere near as simple as matching bit-lengths of keys>

I snip because I want to make a point that is considerably shorter:

Matching bit-lengths has value not in the _technicals_, but because it's a 
Schelling point. Using a 512-or-so-bit curve may very well not provide any 
computational security benefit over a 414-bit curve; nonetheless the 
_psychological_ simplification of "Oh, hashes and ECC need about 2x work 
factor bits, and symmetric keys need about 1x" is a security benefit in 
dealing with the world of humans, especially as regards deployment.

At the security parameters involved at that level, the sacrifice of 
performance involved is unlikely to be a killer (if it was, the user is 
probably using work-factor 128 systems, which happen to be roughly bit-length-
matched anyway).