Subject: [Cfrg] Minimum required work force for additional curve

From: Kurt Roeckx <[email-masked]>
Date: Thu, 26 Feb 2015 20:03:33 +0100

Since I think this hasn't been clearly asked and that it might
explain the answer on the other questions asked, I'm guess I'll
just ask it myself:

Assuming other than the 128 WF curve we only add 1 other curve,
what is the minimum WF it should have?

I'm proposing the following answers, each time 16 bit more:
144
160
176
192
208
224
240
256

Kurt

---

From: Michael Hamburg <[email-masked]>
Date: Thu, 26 Feb 2015 11:51:52 -0800

Hi Kurt,

My view is that once we have a ~WF-128 curve, there’s not that much point in hedging against rho attacks run by faster computers.  This is because in the next few decades, the NSA-KGB-lizardman alliance probably won’t have enough compute power to break Curve25519.  Even if they do, they probably aren’t going to run a computation whose waste heat boils Lac Léman  to read your email, or for that matter, Angela Merkel’s email.  Instead, a stronger curve should be something which (a) might not fall to a math breakthrough which breaks the fast one, and (b) gets people on board who ask “but is there a stronger one” (basically the PHB angle).

For both of these, we want something much bigger than WF-128.  Exactly how much bigger is a nebulous tradeoff of field size, performance and marketability, which is why we’re still having this sort of discussion.

I’m guessing that users who actually need both WF-144+ security against rho attacks and performance better than a WF-192+ curve can provide are a small minority.  If you have some users in mind, though, I’m all ears.

— Mike

> On Feb 26, 2015, at 11:03 AM, Kurt Roeckx <[email-masked]> wrote:
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg