307 digit number factored

[James A. Donald]

travis+ml-cryptography at subspacefield.org wrote:
>> AFAIK, the only advantage of ECC is that the keys are shorter.
>> The disadvantage is that it isn't as well studied.

Nate Lawson wrote:
> Again, this is well covered.  The reason is the fundamental difference
> in the performance of the best-known attacks (GNFS vs. Pollard's rho).
> http://www.vaf.sk/download/keysize.pdf

At the timpe that http://www.vaf.sk/download/keysize.pdf was published, 
1024 bit asymmetric encryption over integers was comparable in strength 
to 80 bit symmetric encryption, and elliptic curve encryption over a 160 
bit fields.

At that time integers based asymmetric encryption took about four times 
as long to compute as the comparable strength elliptic curve asymmetric 
encryption.

Since then, integer encryption has weakened further relative to elliptic 
curve encryption, due to advances in factorization and the discrete log 
problem, increasing the advantage of elliptic curves.

With widespread failure to use encryption due to the computational costs 
a factor of more than four is not to be sneezed at.


---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com