3 ms·
Those two being the choices, I'd go for 41417: arithmetic modulo 2^414-17 is (to me, at least) simpler, and smaller Edwards coefficient. Performance should be i
by pbsd 12y ago
Those two being the choices, I'd go for 41417: arithmetic modulo 2^414-17 is (to me, at least) simpler, and smaller Edwards coefficient. Performance should be in the same ballpark, if not faster.
I wonder if a higher security margin curve is really required here, though. (Block) ciphers usually have to worry about multi-target attacks; 128-bit security starts to feel small in that scenario. But curves don't have that problem: you need to actually do 2^128 computation even in the multi-target case, so it seems less necessary to insist on >256-bit curves. What's the rationale behind the higher security margin curves?
- trevp 12y agoPerformance should be in the same ballpark, but I'd rather go with whichever achieves its security level most efficiently. Goldilocks looks good by that metric [1], so I'm curious how a Curve41417 implementation compares. The rationale for an "extra-strength" curve is the hope it might resist future cryptanalytic breakthroughs. The extra bits aren't needed for brute force, but if some cryptanalysis comes along in 20 years and lops a bunch of "security bits" off, you might be glad you had extra ones... That's a hard thing to quantify, but if we can get, say, 96 extra security bits for only a ~3.5x slowdown over Curve25519, it seems worthwhile. [1] https://docs.google.com/a/trevp.net/spreadsheet/ccc?key=0Aiexaz_YjIpddFJuWlNZaDBvVTRFSjVYZDdjakxoRkE&usp=sharing#gid=0 https://docs.google.com/a/trevp.net/spreadsheet/ccc?key=0Aie...