<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 25, 2017, at 10:53 PM, Bill Cox <<a href="mailto:waywardgeek@gmail.com" class="">waywardgeek@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">It was <a href="https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwiCs_-0yo3XAhVSwWMKHaanC3cQFggoMAA&url=https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fresearch%2Fpublication%2Ffourq-four-dimensional-decompositions-on-a-q-curve-over-the-mersenne-prime%2F&usg=AOvVaw3ki9O5UGTvIxmcJEDgcevi" class="">announced back in 2015</a>. Back then, AFAIK, it was still lacking constant-time implementations, so it was not really possible to benchmark. Now they've got <a href="https://github.com/Microsoft/FourQlib" class="">constant-time code for several variants of ARM, as well as x86</a>. There is also an <a href="https://tools.ietf.org/html/draft-ladd-cfrg-4q-00" class="">IETF draft for standardization</a>, though I understand that does not mean much on its own.<div class=""><br class=""></div><div class="">My Haswell laptop says it takes only 50664 CPU cycles for compressed point multiplication, which should only be around 17us. In contrast, my laptop takes about 100us to perform a NIST P256 point multiplication.<div class=""><br class=""></div><div class="">Do we think this algorithm is secure? Is it growing up?</div></div></div></div></blockquote><br class=""></div><div>I will simply note that you wrote a post about performance, and then asked if it's secure.</div><div><br class=""></div><div>You tell me. Is 17µs secure enough for you?</div><div><br class=""></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Jon</div><div><br class=""></div><br class=""></body></html>