Re: [Cfrg] Elliptic Curves - poll on security levels (ends on February 17th)

[Yoav Nir <[e-mail]>]

> On Feb 10, 2015, at 5:00 PM, Watson Ladd <[e-mail]> wrote:
> 
> On Tue, Feb 10, 2015 at 2:52 AM, Alexey Melnikov
> <[e-mail]> wrote:
>> CFRG chairs are starting a poll, containing 2 initial questions:
>> 
>> Q1: Should CFRG recommend a curve at the 192-bit security level?
>> 
>> Q2: Should CFRG recommend a curve at the 256-bit security level?
>> 
>> Answering Yes/No to each of these would suffice.
>> 
>> Once this first set of issues is resolved, we will move to choices of prime
>> at the selected security level(s), if any. After that we will be
>> discussing implementation specifics and coordinate systems for
>> Diffie-Hellman. We will then make decisions on signature schemes.
>> Please don't discuss any of these future topics at this time.
> 
> Does this mean that 2^448-2^224-1 is not being considered?
> 
> Does this mean that 2^414-17 is not being considered?
> 
> How much distance from 2^192 is allowed? How much from 2^256? Would
> 2^521-1 be an acceptable prime at the 256 bit level?
> 
> I don't know what the above questions mean, so I can't say yes or no.

+1

I don’t see any point in aiming for a particular security level. Sure, there’s the “weakest link” argument although even that’s more involved as evidenced by the separate sub-thread about PKI vs key agreement vs confidentiality vs MAC, but we can set a security level at, say, 192 bits and require a suite of algorithms at at least that level, as NIST did when specifying the higher Suite-B with AES-256 even though they were aiming for 192-bit.

To the point, there may be a reason for recommending 2^448-2^224-1 or 2^414-17, and there may be a reason for recommending 2^521-1. I don’t see a reason for aiming at 2^192, finding something close and declaring that as “good enough”. I’m not at all convinced that there is a likely scenario where it the foreseeable future Curve25519 will be easily enough broken that  people will lose confidence, but the mysterious 192-bit one will still be considered secure.

Yoav