# Which is the smallest safe elliptic curve (bit-length)?

At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits.

At wiki page discrete logarithm records the current record is 114bits.

Is this big gap between 114 and 221 needed?
Is there an EC which passes all those tests but using much less bit?

(use case)
For use case, an EC a little better than the current record would be sufficient. To be exact an EC using a modulo less than $$2^{126}$$ and a close-by cycle length (-1 to 2 bit).
Use case: Given two random points at this EC. It should be hard to compute one value out of the other with a given generator (with known curve, generator, run time values).

(more details)
The current record needed 2000 CPU cores for 6 months.
A future Quantum Computer is allowed to break it. The main user group will be private persons. Any agencies or criminals have less interest in it. It's sufficient if no private person can solve it currently in less than 3 years private PC computation time or in less than a month computation time in the next 10 years. Knowing this information has not that much value, maybe 50\$, in rare cases 1000\$ or 5000\$. Computation methods that require higher costs not worth it (power supply, total usage cost). • Better than the current method is a vague term and your >$2^{125]$only counts the academics. One should define how long do you want to be safe and make an estimation about the growth of attacks over the years. See also Shors attack – kelalaka Jan 29 at 21:01 • @kelalaka there was typo in question ($2^{126}$). Better than the current record (not method). So current computation time should be longer than the current record computation time. As much longer than possible with modulo still$<2^{126}\$.The current record needed 2000 CPU cores for 6 month. – J. Doe Jan 29 at 21:09