Re: [Cfrg] I-D Action: draft-kasamatsu-bncurves-00.txt

[Kohei Kasamatsu <[e-mail]>]

Hi Mike,


Thank you for your comments.

> There are no such BN curves.  I just don't expect that most
> implementers will consider using a 512-bit BN curve, because at that
> size a non-BN curve with k=18 or k=24 has a better trade-off of
> security vs performance.
> But I suppose that such curves might not be
> ISO/IEC compliant, because of their cofactors.

I misunderstood your intentions.

I also think it is better that we use non-BN curve with k=18 or k=24
if we need more higher security than 128-bit.
(For example, the comparison of [1] supports it:-) )

On the other hands, our I-D focuses on BN-curves, as you understand.
I hope new I-Ds which are submitted in the future will achieve the
requirement which you pointed out and such activities will become active.

And, although I also don't expect that most implementers will consider 
using a 512-bit BN curves which are specified in our I-D, we think it is 
valuable to provide parameters and additional information (on security 
and differences between M-type and D-type) of curves with international 
standard.

[1]  http://eprint.iacr.org/2012/232

Cheers,
Kohei KASAMATSU

(2014/01/30 3:31), Mike Hamburg wrote:
>
> On Jan 29, 2014, at 3:01 AM, Kohei Kasamatsu <[e-mail]> wrote:
>
>>> But isn’t 512 bits rather large for a BN curve?  If you’re going to
>>> have a curve that large, it seems to me that you’d want an embedding
>>> degree of at least 18 even though it costs you a giant cofactor.  A
>>> curve with a 512-bit prime and a 384-bit subgroup might get you to
>>> the 192-bit security level.  This would take a 640-bit BN curve at
>>> minimum, with 720 a more conservative guess.
>>>
>>> Source: Freeman 2006, http://eprint.iacr.org/2006/372.pdf.  My
>>> knowledge on this subject is dated, so I’m sure you know better...
>>
>> Thank you for your comments and information on security of our memo.
>>
>> Our memo specifies parameters for compatibility with ISO/IEC document and parameters for high performance. 512-bit curve and 384-bit curves which are compliant with ISO/IEC have 128 security levels because of the following reason.
>> ...
>> If there are parameters of bn-curves with higher security level and high performance, we would like to add it into our memo.
>
>
> There are no such BN curves.  I just don't expect that most implementers will consider using a 512-bit BN curve, because at that size a non-BN curve with k=18 or k=24 has a better trade-off of security vs performance.  But I suppose that such curves might not be ISO/IEC compliant, because of their cofactors.
>
> Cheers,
> -- Mike
>
>
>


-- 
Kohei KASAMATSU

NTT Software Corporation
TEL: [phone] FAX: [phone]
E-mail: [e-mail]