Subject: [Hipsec] Removing DH 384-bit group

From: Robert Moskowitz <[email-masked]>
Date: Thu, 22 Apr 2010 11:21:25 -0400

This is a very weak DH group we put in to have some DH for weak systems.

How does the computational cost of ECDH-256 compare to it?  How small of 
a ECDH key would be of similar computational cost (and probably 
stronger)?  Seems easier to add a small ECDH that keep this weak key in.

I am working on Diet HIP exchange that will be for truly little 
systems.  Work is dragging, as I want to get through 5201-bis first (and 
dealing with items like this one).

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 22 Apr 2010 16:27:38 -0400

On 04/22/2010 11:21 AM, Robert Moskowitz wrote:
> How does the computational cost of ECDH-256 compare to it? How small 
> of a ECDH key would be of similar computational cost (and probably 

I found: http://www.nsa.gov/business/programs/elliptic_curve.shtml and 
it gives some basic numbers on the computational cost of ECDH vs DH. 80 
bit security 160 ECDH which is 1/3 the cost of the DH equiv. This is 
probably NOT as cheap as DH-384, but probably 'good enough', plus it is 
documented what you get with ECDH-160.

If someone feels we should have something weaker than ECDH-160, please 
chime in.

> systems. Work is dragging, as I want to get through 5201-bis first 
> (and dealing with items like this one).
>
>
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec
>

---

From: Oleg Ponomarev <[email-masked]>
Date: Fri, 23 Apr 2010 10:01:44 +0300 (EEST)

Hi! On Thu, 22 Apr 2010, Robert Moskowitz wrote:

> How does the computational cost of ECDH-256 compare to it?  How small of a 
> ECDH key would be of similar computational cost (and probably stronger)? 
> Seems easier to add a small ECDH that keep this weak key in.

DH384 takes ~124 usec using Intel Xeon E5440 @ 2.83GHz
ECDH112 -/- 175 usec (56-bit strong and weakest available in OpenSSL)

With Nokia tablet N810:
DH384 ~5.0 msec
ECDH112 ~4.6 msec
ECDH128 ~5.2 msec
ECDH160 ~7.7 msec
(DH768 ~33.9 msec)

-- 
Regards, Oleg.

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 23 Apr 2010 07:38:28 -0400

> ECDH112 -/- 175 usec (56-bit strong and weakest available in OpenSSL)

Great numbers. thanks. Do you have a ECDH equiv for 100bits strength (as 
the DH-1536 seems to work out to)? Probably ECDH-200 or there abouts.

In my searching for info on this, I encountered a dead link for a paper 
of yours on EC with HIP....

---

From: Oleg Ponomarev <[email-masked]>
Date: Tue, 27 Apr 2010 23:09:23 +0300 (EEST)

Greetings! On Fri, 23 Apr 2010, Robert Moskowitz wrote:

> Great numbers. thanks. Do you have a ECDH equiv for 100bits strength (as the 
> DH-1536 seems to work out to)? Probably ECDH-200 or there abouts.

Sure, ECDH-192 takes 384 usec for the Xeon and 11.8 msec for N810.

> In my searching for info on this, I encountered a dead link for a paper of 
> yours on EC with HIP....

It is available, e.g. at http://www.cs.helsinki.fi/u/gurtov/papers/ecc.pdf

-- 
Regards, Oleg.