5
$\begingroup$

So this comes from the professional rumor-mill, and I'm wondering if anyone might either debunk or shed light on this.

My understanding is ECC is generally now preferred over RSA simply due to how much more efficiently it operates. After a 2048 key length, RSA simply doesn't return as much value for a longer key length. whereas ECC can offer greater levels of protection for much less processing overhead.

Is there discussion about a more efficient/powerful alternative to ECC which NIST is preparing to favor (if not already) ahead of ECC? And if so, what might that be?

$\endgroup$
  • 2
    $\begingroup$ Given the timescales at which NIST operates and the immaturity of the post-quantum-crypto field, I'd interpret soon as something like "5 to 10 years from now". $\endgroup$ – CodesInChaos Nov 7 '15 at 10:21
4
$\begingroup$

To my knowledge, NIST has not really decided or announced anything about successors to ECC. However, they do run workshops and such on post-quantum cryptography, so when the time is right something will probably move towards standardization.

NSA, on the other hand, recently announced that they will soon push for a post-quantum system, going so far as to say that moving from RSA to ECC may be unnecessary in the mean time.

The reason here is not performance or efficiency, however. By many measures the possible candidates for the successor are less efficient. Instead, they want something that remains secure even if quantum computers become practical (known as post-quantum security). Neither ECC nor RSA has that property.

But no, no specific alternative has yet been chosen. Because of this and the above mentioned recommendation to skip ECC, some have even wondered whether post-quantum security is the actual reason for the announcement.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.