[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Fwd: Re: P1363: prudent fields]
The security risk justified by performance should never be taken,
especially given the fact that there is no significant difference
in performance while comparing 155-bit and 163-bit curves.
Thanks,
Yuri
Hilarie Orman wrote:
>
> Composite exponents permit implementation using field
> towers and lead to performance advantages.
>
> Hilarie
>
> >>> Sandy Harris <sandy@storm.ca> 06/26/01 11:48AM >>>
> Hilarie Orman wrote:
> >
> > Given that the groups have no demonstrated mathematical
> > weaknesses
>
> However, enough problems with composite exponents have shown up
> that we just got this advice from a wel--known crytographer:
>
> | More generally, we recommend that elliptic curves over GF(2^n)
> | where be n is composite be avoided, including elliptic curves
> | over GF(2^185).
>
> > and that they have significant computational performance advantages,
>
> If performance depends only on the size of exponent, then those
> groups -- 2^155 and 2^185 -- have about the same performance as
> the group using 2^163.
>
> > there appears to be no reason to drop them.
>
> I'd say there's enough doubt that the cautious course would be to
> drop them.