Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Daniel Kahn Gillmor <[e-mail]>]

On Tue 2015-02-10 14:15:09 -0500, Станислав Смышляев wrote:

> the Russian digital signature standard strictly requires that the
> order of the prime subgroup of a curve either lies between 2^(254) and
> 2^(256) or lies between 2^(508) and 2^(512) - and one won't generate a
> curve with a cofactor of 512 (=2^(521-512)).

This feels a bit like begging the question to me: without more
explanation, saying the "Russian digital signature standard strictly
requires" still seems arbitrary.  Does the Russian digital signature
standard provide an explicit rationale for the upper bound?

Maybe more detail would be useful:

Will there be systems unable to adopt new recommended curves at that
security level because of a larger group?  how many?  what sorts of
systems?  Which Russian digital signature standard exactly?  Can you
provide a pointer so that people unfamiliar with it can see what the
constraints are themselves?

How much will the Russian Digital Signature standard need to be updated
to allow the use of any new curves?  If it needs to be updated anyway,
could it be also updated to allow 521-bit curves if we manage to get a
rough consensus from other participants?

By comparison, the NIST folks (from the US gov't) seem open to
considering new curves in the near future.  Is that flexibility
something that the agency governing the standards in question can also
provide?

I think we can take your concerns into better consideration (and we can
make better decisions as a group) the more details we know about these
constraints.

        --dkg