Subject: [Cfrg] The 512/521 thing Re: Elliptic Curves - poll on security levels (ends on February 17th)

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 10 Feb 2015 18:43:00 -0500

On Tue, Feb 10, 2015 at 2:15 PM, Станислав Смышляев <[email-masked]>
wrote:

> Dear Daniel,
>
> the Russian digital signature standard strictly requires that the order of
> the prime subgroup of a curve either lies between 2^(254) and 2^(256) or
> lies between 2^(508) and 2^(512) - and one won't generate a curve with a
> cofactor of 512 (=2^(521-512)).

The only way I can see someone coming up with that requirement is by first
deciding that Curve 25519 is close enough to 256 to not be worth worrying
about the extra bit and then writing the bill so that it works for that
specific special case without either making it look like it is a special
case or opening the door to lots of other special cases.

I don't want to get into making allowances for special crypto for any
governments. Do it for one and we end up having to do it for 200.

But we are in a position where what we really need are rejection criteria.
Arbitrary objective criteria make reaching a decision easier than
subjective not very sharp criteria.

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Wed, 11 Feb 2015 10:12:33 +0300

Dear Philip,

I totally agree with you about "special crypto for any governments", but
the Russian GOST standard is included in ISO/IEC document: ISO/IEC
14888-3:2006/Amd.1:2010(en) Information technology — Security techniques —
Digital signatures with appendix — Part 3: Discrete logarithm based
mechanisms AMENDMENT 1: Elliptic Curve Russian Digital Signature Algorithm,
Schnorr Digital Signature Algorithm, Elliptic Curve Schnorr Digital
Signature Algorithm, and Elliptic Curve Full Schnorr Digital Signature
Algorithm.

Moreover, the Russian PKI is not under control of our government, but all
banks and commercial organizations work with crypto fulfilling standard
requirements, so there cannot be any talk at all about "crypto for
governments".

Kind regards,

Stanislav

2015-02-11 2:43 GMT+03:00 Phillip Hallam-Baker <[email-masked]>:

>> the Russian digital signature standard strictly requires that the order
>> of the prime subgroup of a curve either lies between 2^(254) and 2^(256) or