Re: [Cfrg] Summary

[Michael Hamburg <[e-mail]>]

> On Jan 1, 2015, at 9:25 AM, Christoph Anton Mitterer <[e-mail]> wrote:
> 
> On Thu, 2015-01-01 at 10:50 -0500, Watson Ladd wrote: 
>> Above 255 bits, life gets more interesting. Assuming we want to use
>> X-coordinate Montgomery (sorry Mike) for ECDH and compressed Edwards
>> for sigs, we've got 3 or 4 different proposals for around 380, and 1
>> for 521.

Heh.  My alternative point encoding stuff is just an experiment.

>> -For 521 it's E521 as described on safecurves.cr.yp.to, the prime being 2^521-1

> Is this going to be followed up?

Yes, at some point.

> I'd really love so see a trustworthy curve that has an extremely high
> security margin... something like "as long as there are no quantum
> computers and no other break through against the base paradigms is found
> - no collected computing power will 'ever' be able to break this"...
> that could be used in fields like OpenPGP... for long-term key signing,
> where performance doesn't matter that much.


I agree.  That said, 521 bits is overkill for this.    For a 384-bit prime, you already need an amount of energy equal to many stars’ outputs over their entire lifetimes.  (The Universal Security paper would suggest about a million Sun-like stars, but I don’t recall what temperature they’re assuming the computation will take place at.)  Even in a science-fiction world where humanity is capable of such feats, it will not be worth snuffing stars to break your PGP key.

I consider every prime past 2^256, and certainly every prime past say 2^320, to be a hedge against limited math breakthroughs and not against faster computers.  So it’s really tricky to evaluate where to set the security levels.

Cheers,
— Mike