Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

[Ilari Liusvaara <[e-mail]>]

On Wed, Feb 25, 2015 at 02:27:58PM +0000, Alexey Melnikov wrote:
> CFRG chairs are starting another poll:
> 
> Q3: This is a Quaker poll (please answer one of "preferred", "acceptable" or
> "no") for each curve specified below:

Considering entiere space for high-security curve...
 
> 1) 448 (Goldilocks)

Prefer (high-performance curve with well-characterized performance
characteristics, easy to construct signatures).

> 2) 480

No (bad performance on 32-bit[1], marginal with signatures)

> 3) 521

No (too slow and large for signatures, uncertain security benefits[2]).

> 4) other curve (please name another curve that you "prefer" or "accept", or
> state "no")

p=2^414-17  (accept[3])



[1] This is in contrast to stellar performance at 64-bit. And 32-bit
performance still looks to matter (mobile, which is already loaded and
slow!)

[2] The rho complexities are so high that I think it is meaningless to
compare those. Basically, I think that is reasonably likely that anything
that can break any one of these curves can break them all (especially at
WF200+)[4].

[3] There have been decent amount of performance characterization of this
prime, even if there is no good software available. It is WF200+ too.

[4] Some examples:

1) Major advances to ECC cryptoanalysis (no telling what that does to
   ECC)
2) Large quantum computers (totally breaks ECC).
3) Fundamential physics breakthroughs allowing far surpassing current
   theoretical limits (no telling what that does to computational
   capability; however I think this is less likely than large QC).


-Ilari