IETF Logo Mail Archive

Re: [Cfrg] Elliptic Curves - poll on specific curve around 256bit work factor (ends on February 23rd)

Alyssa Rowan <akr@akr.io> Wed, 18 February 2015 13:31 UTC

Return-Path: <akr@akr.io>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA5631A049C for <cfrg@ietfa.amsl.com>; Wed, 18 Feb 2015 05:31:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 61d3g0z_JNo5 for <cfrg@ietfa.amsl.com>; Wed, 18 Feb 2015 05:31:42 -0800 (PST)
Received: from entima.net (entima.net [78.129.143.175]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83F411A874A for <cfrg@irtf.org>; Wed, 18 Feb 2015 05:31:42 -0800 (PST)
In-Reply-To: <20150218123243.GA19166@LK-Perkele-VII>
References: <54E46EA4.9010002@isode.com> <20150218123243.GA19166@LK-Perkele-VII>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
From: Alyssa Rowan <akr@akr.io>
Date: Wed, 18 Feb 2015 13:31:35 +0000
To: Alexey Melnikov <alexey.melnikov@isode.com>
Message-ID: <50E91860-0740-468D-9E3B-7C1977E5697C@akr.io>
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/pXyTbDYS1szffcYhFpfBNnylpE8>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] Elliptic Curves - poll on specific curve around 256bit work factor (ends on February 23rd)
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Feb 2015 13:31:45 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 18 February 2015 12:32:43 GMT+00:00, Ilari Liusvaara <ilari.liusvaara@elisanet.fi> wrote:

>> Q3: (For people who want CFRG to recommend a curve at 256bit level)
>> Is bandwidth cost of going to p521 worth the speed win over primes closer to 512 bits?
>Yes, it is a win.

+1 yes from me, too.

If we're going to be doing a ≈WF256 curve, then on balance I'd far rather have the one which is 2 bytes longer but is a Mersenne prime with ≈42% faster muls and ≈27% faster sqrs than the weaker 2^512-569¹.

We'd be fools not to, really.

___
[1] From Mike Hamburg's data comparing an optimised E-521, I think it was - which I think this would end up as? - to the MSR NUMS curve over 2^512-569.

- --
/akr
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQI3BAEBCgAhBQJU5JQ3GhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
jtkWi2t65FgQAJ2Lmg99xjTfBCJs13q9KmeCYWZK+YDd3LomAH4gfhNhgPXjY3Kr
Yj7Wy8xUxlVZK8cJWFnOcIyQcXouaQhD0ayXwSK42GFLrXIj0DQmDbSOV2JHh/35
4X+KEXCGOXg4S8vTSE4XD+5z9l54njyCIt4jFro6TY6zB2ZVfHh8rN+wX1BWJtJ7
zE/JaWumZvRmPSJReDWcPhjUQvErezoxwv7/VYVvmu/ZwEtBylU1d3HwGOHad2jc
hbAgNccrYY5a6940G6FiX/PFMpybP6fAYZklFx0px57DHNAVX2TRc8hRycyHGPCr
4EkXzCR0RDCUlWRRKxHxVro3oAQRhq1F3R8K5tPP6h4Uykvst7DovY7DHX7NuiL8
E1tVuPfpACEnYgvyAceKdPfVj9LZ+7BFYEMmmcr0uBl/DxhXjK7BUPaPPFAU8NsN
kFs+dp1B7ICaBHgxBGKeRjQlLN5yEK4ftGhgQHiQTYD4JXuTDJyRFRGtcG9Zp2Z0
Iiosc7xZ0ydKfl+/J0JWkMFb6skhAdFntGf/GH/douJ/bEZIoyX3kfo3DY9WW+6i
bBmkZh9CbgJmAuo1raBW7JqnXujB7m5oVAjXx7Xkc+RHIR1Bewo/U5ymxK2Gy6F3
R9xiqxIliHnYH2RsyLMFL7GJxNgcqMvARvIEOsXSbke/B/ckY6o3AJEd
=pmuM
-----END PGP SIGNATURE-----

v2.26.15 | Report a Bug | By Email | System Status