At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits.

At wiki page discrete logarithm records the current record is 114bits.

Is this big gap between 114 and 221 needed?
Is there an EC which passes all those tests but using much less bit?

(use case)
For use case, an EC a little better than the current record would be sufficient. To be exact an EC using a modulo less than $2^{126}$ and a close-by cycle length (-1 to 2 bit).
Use case: Given two random points at this EC. It should be hard to compute one value out of the other with a given generator (with known curve, generator, run time values).

(more details)
The current record needed 2000 CPU cores for 6 months.
A future Quantum Computer is allowed to break it. The main user group will be private persons. Any agencies or criminals have less interest in it. It's sufficient if no private person can solve it currently in less than 3 years private PC computation time or in less than a month computation time in the next 10 years. Knowing this information has not that much value, maybe 50\$, in rare cases 1000\$ or 5000\$. Computation methods that require higher costs not worth it (power supply, total usage cost).

  • 1
    $\begingroup$ Better than the current method is a vague term and your > $2^{125]$ only counts the academics. One should define how long do you want to be safe and make an estimation about the growth of attacks over the years. See also Shors attack $\endgroup$
    – kelalaka
    Jan 29, 2020 at 21:01
  • 1
    $\begingroup$ @kelalaka there was typo in question ($2^{126}$). Better than the current record (not method). So current computation time should be longer than the current record computation time. As much longer than possible with modulo still $<2^{126}$.The current record needed 2000 CPU cores for 6 month. $\endgroup$
    – J. Doe
    Jan 29, 2020 at 21:09

1 Answer 1


It really depends on what you need it for. Protecting top secret confidential files? Better use 384. Computing an example for your class? Maybe 5-bit. There is a lot in between and it is your choice.

  • $\begingroup$ Have you ever consider the case of someone build a Cryptographical Quantum Comoputer? $\endgroup$
    – kelalaka
    May 5, 2023 at 8:33
  • $\begingroup$ Yes, but it isn't my choice to make a decision on that. If you are worried switch to lattice cryptography. $\endgroup$ May 5, 2023 at 14:01
  • $\begingroup$ I'm not the down voter. The reason this question not answered there is no complete answer... $\endgroup$
    – kelalaka
    May 5, 2023 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.