Author: Jeffrey WaltonJeffrey Walton
Date: Nov 8, 2006 11:40
Hi All,
I'm currently working on a project which will expose students to ECC.
We want the students to break an ECC system (i.e., finding the scalar k
of W=kG over curve E). However, we can't throw a 160 bit NIST curve at
them.
What I'd like to know:
1) What is a good ('average') curve size? Base it on a typical PC -
1.5GHz Pentium. I'd like an average of 150-200 hours to break (one
computer-week or a small fraction of a MIPS year?). My first thought is
to try a few curves in the 50 - 80 bits (preferably over GF(p)).
2) Where is a good basic reference on curve parameter selections? For
example, chose a 60 bit curve. What would be good selections for a and
b without hitting a degenerate case?
3) Is there an 'equivalency' below 160 bits? For example, I have read
160 bit ECC ~= 1024 bit RSA. If the equivalency is valid below 160
bits, is it linear in nature?
|