Re: [Cfrg] Elliptic Curves - poll on specific curve around 256bit work factor (ends on February 23rd)

[Andrey Jivsov <[e-mail]>]

On 02/18/2015 02:51 AM, Alexey Melnikov wrote:
> CFRG chairs are starting another poll:
>
> Q3: (For people who want CFRG to recommend a curve at 256bit level) Is
> bandwidth cost of going to p521 worth the speed win over primes closer
> to 512 bits?

Yes.

A typical TLS handshake, no client authentication (3 X.509 certs in the 
server chain), is 4Kb.

There might be an issue in scenarios like sending an S/MIME message to N 
recipients, but RSA is common (very wasteful), otherwise, uncompressed 
points are common. There is typically additional per-recipient overhead 
for headers. Overall, for N recipients this translates to about ~5% 
overhead per recipient, whereas the lack of compression is about ~95%.

The key size is an issue when users need to enter keys manually. But 
with with base32 encoding this is 51 characters for P-256 (removing a 
bits with https://tools.ietf.org/html/draft-jivsov-ecc-compact-05 as 
needed), which is already annoyingly large. Beyond this, a few 
characters won't make the user experience friendly.