4 ms·
It is entirely plausible that an attack is found which halves the number of bits of all EC algorithms (this is about the amount of progress on integer factoriza
by adgjlsfhk1 4y ago
It is entirely plausible that an attack is found which halves the number of bits of all EC algorithms (this is about the amount of progress on integer factorization during the 20th century). With such a breach, 1W28 bit security is no longer enough, but 220 bits is. When the performance difference is marginal, I think it makes a lot of sense to build in some wiggle room for a little breakage
- stouset 4y agoThat’s true of quantum attacks on symmetric systems, but I’m not aware of any work that hints toward such a possible future for elliptic curves. If you know of something I’d love to hear it.
- adgjlsfhk1 4y agoI don't know of any possible future for such attacks. My point is just that it's really hard to estimate the probability of unknown mathematical advancement so especially for secrets that you want to keep for a while, it's sensible to build in some buffer for mathematical advancement. I'm not an expert, but I would have a hard time being 99% sure that no one will come up with a sub-exponential algorithm (e.g. some sieving technique) that speeds up solving discrete logs (but doesn't make it trivial). If the cost of the improvement were high it would be a hard tradeoff, but I really don't see a strong argument that the extra couple nanoseconds are that important here.