# Why is the P-521 elliptic curve not in Suite B if AES256 is?

In the NSA's document, "The Case for Elliptic Curve Cryptography", we have

+---------------+-------------------------+-----------------+
| Symmetric Key | RSA and Diffie-Hellman  | Elliptic Curve  |
| Size (bits)   |      Key Size (bits)    | Key Size (bits) |
+---------------+-------------------------+-----------------+
|       80      |            1024         |       160       |
|      112      |            2048         |       224       |
|      128      |            3072         |       256       |
|      192      |            7680         |       384       |
|      256      |           15360         |       521       |
+---------------+-------------------------+-----------------+

Table 1: NIST Recommended Key Sizes


In NSA Suite B, we do have AES256 (for TS), however the the ECC is limited to P-384, despite P-521 officially codified in NIST FIPS-186-4. This appears to introduce an entropic choke point if we're have a crypto "pipeline".

Example: If we're doing ECDH off P-384 keys to then AES256 encrypt, we're effectively passing just 192 bits of keying entropy into the AES256 engine.

Regarding NSA's omission of P-521, P-256 and P-384 will satisfy all of the U.S. Government's requirements so only these are included in Suite B. We don't have a requirement that warrants the inclusion of P-521.

I'm not able to piece these seemingly contradictory pieces of data, so I thought I'd ask other here. Why was P-521 excluded? Is it technical or non-technical? Additional info would be appreciated.

EDIT: Not very directly related but I checked some empirical testing results. Seems compute times roughly double going from P-256 => P-386 => P-521, for almost any EC operation. Take for example signing a short (1200 bytes) message.

P-256:  8ms ( 64 byte signature)
P-384: 15ms ( 96 byte signature)
P-521: 30ms (132 byte signature)


It's not directly representative of the entropic bottleneck above, more aligned towards the "good enough" line of thought. But then, AES192 should have also sufficed...

-
OK, so you found out that there is indeed a linear relation between computation time and ECC key size. This is a well known property of ECC and one of the reasons why ECC may be more future proof than e.g. RSA. Note that it is not possible for us to look into the mind of those generating the documents. The only thing I can tell is that e.g. the brainpool curves use a well defined set of domain parameters for a keysize of 512 bits. In general it is easier to handle data types that are a power of two and a multiple of 8. –  owlstead Aug 24 '13 at 1:12