Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

Ilari Liusvaara <> Mon, 02 March 2015 14:28 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id E7FC71A877D for <>; Mon, 2 Mar 2015 06:28:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.501
X-Spam-Status: No, score=-0.501 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id hPqcc01_ZMGh for <>; Mon, 2 Mar 2015 06:28:46 -0800 (PST)
Received: from ( []) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5B2761A8774 for <>; Mon, 2 Mar 2015 06:28:45 -0800 (PST)
Received: from LK-Perkele-VII ( []) by (Postfix) with ESMTP id 83EA51A263A; Mon, 2 Mar 2015 16:28:43 +0200 (EET)
Date: Mon, 02 Mar 2015 16:28:43 +0200
From: Ilari Liusvaara <>
To: Alexey Melnikov <>
Message-ID: <20150302142843.GA32307@LK-Perkele-VII>
References: <>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: Ilari Liusvaara <>
Archived-At: <>
Cc: "" <>
Subject: Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 02 Mar 2015 14:28:48 -0000

On Wed, Feb 25, 2015 at 02:27:58PM +0000, Alexey Melnikov wrote:
> CFRG chairs are starting another poll:
> Q3: This is a Quaker poll (please answer one of "preferred", "acceptable" or
> "no") for each curve specified below:

Considering entiere space for high-security curve...
> 1) 448 (Goldilocks)

Prefer (high-performance curve with well-characterized performance
characteristics, easy to construct signatures).

> 2) 480

No (bad performance on 32-bit[1], marginal with signatures)

> 3) 521

No (too slow and large for signatures, uncertain security benefits[2]).

> 4) other curve (please name another curve that you "prefer" or "accept", or
> state "no")

p=2^414-17  (accept[3])

[1] This is in contrast to stellar performance at 64-bit. And 32-bit
performance still looks to matter (mobile, which is already loaded and

[2] The rho complexities are so high that I think it is meaningless to
compare those. Basically, I think that is reasonably likely that anything
that can break any one of these curves can break them all (especially at

[3] There have been decent amount of performance characterization of this
prime, even if there is no good software available. It is WF200+ too.

[4] Some examples:

1) Major advances to ECC cryptoanalysis (no telling what that does to
2) Large quantum computers (totally breaks ECC).
3) Fundamential physics breakthroughs allowing far surpassing current
   theoretical limits (no telling what that does to computational
   capability; however I think this is less likely than large QC).