# Can we apply elliptic curves to reduce key sizes in symmetric cryptography?

elliptic curve reduces key sizes thus reducing storage and transmission requirements and also provide the same level of security.

Symmetric encryption such as AES needs to increase its key size to ensure the same level of security in a post quantum crypto world. But

Can we apply elliptic curves to reduce key sizes in symmetric cryptography?

Nathan Aw

elliptic curve reduces key sizes thus reducing storage and transmission requirements and also provide the same level of security...

... compared to RSA.

We don't use RSA in symmetric cryptography, and so that logic does not apply.

For AES, we believe that:

• On a conventional computer, it takes circa $2^{128}$ AES evaluations to find a 128 bit AES key (or find the plaintext from a ciphertext encrypted with an unknown 128 bit key)

• On a Quantum Computer, it takes circa $2^{128}$ quantum AES evaluations to find a 256 bit AES key (or find the plaintext from a ciphertext encrypted with an unknown 256 bit key)

Both these attacks are generic, that is, they would apply to any such transform. Hence, there isn't a way to 'shrink' these keys (apart from simply making the decryption operation vastly more expensive, which we don't care to do).

BTW: why would we need to shrink a 256 bit AES key?

No, that doesn't work, if just for the fact that an unbroken cipher provides the same level of security as the actual, encoded key size. AES provides near 128 bits of security for a 128 bit key and near 256 bits of security for a 256 bit key. So it is next to impossible to create a key that offers more security than AES per bit by definition.

ECC provides about 128 bits of security for a 256 bit key. So even the smallest encoded key will require twice as much storage as an AES key. If you consider quantum crypt-analysis then the security of AES will approximately be halved (so you need a 256 bit key) but the security of ECC will become destroyed given a large enough quantum computer.

So no, you cannot use ECC to bring down the key size of AES. Compared to RSA or DSA keys the efficiency of ECC is remarkable, and both ECC and RSA or DSA are not quantum-resistant. In principle you need a larger computer than ECC, but that difference is only about 4 times. If we can build a quantum computer to break ECC then one that breaks RSA for its large key sizes will not be too far away.

To give you some ideas about key sizes (not considering quantum computing) take a look at keylength.com.