Re: [Cfrg] Another perspective on the Curve256/255 problem

"Salz, Rich" <rsalz@akamai.com> Thu, 31 July 2014 17:43 UTC

From: "Salz, Rich" <rsalz@akamai.com>
To: Phillip Hallam-Baker <phill@hallambaker.com>, "cfrg@irtf.org" <cfrg@irtf.org>
Date: Thu, 31 Jul 2014 13:43:56 -0400
Thread-Topic: [Cfrg] Another perspective on the Curve256/255 problem
Thread-Index: Ac+s5Bc3VrmbbAxqTQWAaJCEW0eZoQAAfYfw
Message-ID: <2A0EFB9C05D0164E98F19BB0AF3708C718599EE460@USMBX1.msg.corp.akamai.com>
References: <CAMm+LwgZp4sgLaFZeWV05UDvN=x7FUNbM5Gi32fJRRrKmais+A@mail.gmail.com>
In-Reply-To: <CAMm+LwgZp4sgLaFZeWV05UDvN=x7FUNbM5Gi32fJRRrKmais+A@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/sQlDDSnhiVs4Udvmn2z39sHzmss
Subject: Re: [Cfrg] Another perspective on the Curve256/255 problem
Precedence: list

> [I am using WF128 to remind ourselves that this is a 2^128 Work Factor which
> is what really matters here.]

I like this notation.

> So PKIX, S/MIME and OpenPGP should just use WF256. Which means that a
> TLS stack is going to need the ability to do WF256.

Can you explain this?  I don't see the "which means" justification, which means I'm missing something.

> DJB: Speed! Speed! Speed!

That's not how I would characterize it.  One of Dan's slides said something about removing the friction between security and performance. I wish I wrote it down, it was a brilliant insight.  The first time I've seen a real systems approach to crypto (which probably says more about my ignorance of the field than anything else).  For example, Curve25519 requires the top bit to be set, so that implementers don't expose timing attacks by skipping down until they find the first bit set.

I think everyone agreed with rigidity as a good principle to follow.  Caesar's wife must be above suspicion.

--  
Principal Security Engineer
Akamai Technologies, Cambridge MA
IM: rsalz@jabber.me Twitter: RichSalz

[Cfrg] Another perspective on the Curve256/255 pr… Phillip Hallam-Baker
Re: [Cfrg] Another perspective on the Curve256/25… Salz, Rich
Re: [Cfrg] Another perspective on the Curve256/25… Phillip Hallam-Baker
Re: [Cfrg] Another perspective on the Curve256/25… Salz, Rich
[Cfrg] A few good primes D. J. Bernstein
Re: [Cfrg] A few good primes Michael Hamburg