harleyargotech robert harley gordon mohr wrote mean eliptic curve encryption easily breakable faster loss strength stronger raw bits ok cooked bits better oh ok results dont help break ec crypto rsa pick number secret factors break cryptosystem factor number due fast subexponential algorithms factoring number better 1024 bits least record 524 bits ec pick curve pick points curve secret discrete logarithm break cryptosystem compute discrete log best algorithms random curves exponential record 109 bits slightly special curve people pick curves chosen small fixed set one choice curves special properties originally chosen make pointcounting easier also speed crypto operations cases also speed attacks curves deployed moment danger exists choice precompute handful random curves nsa years ago took hours fast machine nist standardized curves changes possible generate curves ordinary pc getting easier easier small curves taking seconds fast machine since year two even reasonably big curves take seconds typical pc means dont rely standard curves distribute risk many curves case get broken stage certain circumstances even keep curve secret attacker doesnt know discrete log try compute isnt really good analogy rsa imagine wanting factor number dont even know basically recent progress made new things feasible makes even underlying primitives signing encoding affected security vibes get better r httpxentcommailmanlistinfofork tue 20 aug 2002 182444 0200 cest elliptic curve point counting made easy