Subject: Re: [Cfrg] Meeting notes

From: Derek Atkins <[email-masked]>
Date: Wed, 01 Apr 2015 16:24:52 -0400

Ilari Liusvaara <[email-masked]> writes:

> I haven't really looked, but on surface the algorithm doesn't look to
> be friendly for constant-time implementation. Matrix row or column
> swaps are involved?

No, it does not involve row or column swaps.

> So constant-time implementation would likely be a lot slower (it could
> still be much faster than ECC).

It's actually not slower; indeed, our current implementatons (both in
software and hardware) are constant time.

> Modern CPUs and OSes are pretty ridiculously vulernable to timing
> attacks. Even across VMs.
>
>
> Another advantage: It uses medium primes, which are much
> easier to work with than large primes (one can't use medium primes
> with ECC due to weak fields). For CPU work, 2^31-1 looks to be pretty
> convinient prime.

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 13 Apr 2015 14:22:41 +0100

On 27/03/2015 12:49, Yoav Nir wrote:
> The chairs will post the edited notes when they get the chance to go 
> over them. But I’ve posted the raw notes below.
I posted a slightly edited version:

http://www.ietf.org/proceedings/92/minutes/minutes-92-cfrg

Please send your corrections to the chairs.