[Cfrg] A case for E-521

[Paulo Sergio Licciardi Messeder Barreto <[e-mail]>]

Greetings. 

Sorry for my late entry in these discussions, I was only recently made aware of them. 

I would like to suggest that, for the top security level, the curve E-521 (or its equally secure quadratic twist) as defined in <http://eprint.iacr.org/2013/647> be considered. 

E-521 was discovered independently by at least three teams (1. M. Hamburg; 2. D. Bernstein and T. Lange; 3. The authors of <http://eprint.iacr.org/2013/647>, including myself). In fact, I see that this curve has appeared in the discussions already, and this is intended to be a complement to that. 

The substantial advantages of E-521 (not only in terms of speed on some particular platform, but in a portable manner as well) over other curves at the same security level, including P-521 and other curves reported in <http://eprint.iacr.org/2014/130>, were recently corroborated by a fourth, independent team <http://eprint.iacr.org/2014/852>. These results were obtained with the Miracl library, which is publicly available and hence makes reproducibility a straightforward matter. Unsurprisingly, E-521 will be quite hard to beat if at all. Further comparisons by other teams are under way. 

E-521 has been proposed to the Brazilian government (by the Special Committee on Security of the Brazilian Computer Society; a copy of that document, in Portuguese, can be found at <http://www.larc.usp.br/~pbarreto/manifesto-curvas.pdf>) for official use at the higher security level, both domestically and in passports, in replacement of NIST and Brainpool curves. 

Regards, 

Paulo Barreto.