cr.yp.to update

 ecdh.html         |    6 +++
 ecdh/reports.html |  101 +++++++++++++++++++++++++++++-------------------------
 2 files changed, 61 insertions(+), 46 deletions(-)
diff -ru .old-crypto/ecdh/reports.html cr.yp.to/ecdh/reports.html
--- .old-crypto/ecdh/reports.html	2005-09-19 10:29:26.000000000 -0400
+++ cr.yp.to/ecdh/reports.html	2005-09-20 10:32:38.000000000 -0400
@@ -24,6 +24,15 @@
 ``Constant time: yes'' means that the
 software speed is independent of n and P.
 <p>
+The ``known attack'' column describes, for each curve,
+the known discrete-logarithm algorithm
+having the lowest price-performance ratio.
+In each case,
+the fastest algorithm is a Pollard-type algorithm
+dominated by elliptic-curve additions.
+These algorithms have very low communication costs
+and parallelize perfectly across many processors.
+<p>
 <table border>
 <tr>
 <th>constant time</th>
@@ -32,57 +41,57 @@
 <th>field size</th>
 <th>curve</th>
 <th>key bits</th>
-<th>security conjecture</th>
+<th>known attack</th>
 <th>source</th>
 </tr>
-<tr><td>no</td><td>500000</td><td>Alpha 21264</td><td>(2^61-1)^3</td><td></td><td>366</td><td>181</td><td>1999 Kobayashi Morita Kobayashi Horito</td></tr>
-<tr><td>no</td><td>580000</td><td>Pentium II</td><td>2^163</td><td>NIST K-163</td><td>326</td><td>155</td><td>2000 Hankerson Hernandez Menezes</td></tr>
-<tr><td>no</td><td>595537</td><td>Athlon (642)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>610000</td><td>Pentium III</td><td>2^163</td><td></td><td>326</td><td>155</td><td>2001 Harley</td></tr>
-<tr><td>yes</td><td><a href="speed-20050915-thoth.txt">624786</a></td><td>Athlon (622)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>255</td><td>2005 Bernstein</td></tr>
-<tr><td>yes</td><td><a href="speed-20050915-whisper.txt">640838</a></td><td>Pentium M (695)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>255</td><td>2005 Bernstein</td></tr>
-<tr><td>no</td><td>650000</td><td>Alpha 21264</td><td>(2^61-1)^3</td><td></td><td>366</td><td>181</td><td>1999 Bailey Paar</td></tr>
-<tr><td>no</td><td>668566</td><td>UltraSPARC II</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>678633</td><td>Athlon (642)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>724776</td><td>Pentium III (672)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>726922</td><td>Pentium III (686)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>734731</td><td>Pentium II (652)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>780000</td><td>Pentium II</td><td>2^192-2^64+1</td><td>NIST P-192</td><td>384</td><td>192</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
-<tr><td>no</td><td>780000</td><td>Pentium II</td><td>(2^31-1)^6</td><td></td><td>372</td><td>183</td><td>1999 Kobayashi Morita Kobayashi Horito</td></tr>
-<tr><td>no</td><td>785900</td><td>UltraSPARC II</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>823862</td><td>Pentium III (672)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>826955</td><td>Pentium III (686)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>827360</td><td>Pentium 4 (f05)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>yes</td><td><a href="speed-20050915-silverton.txt">832457</a></td><td>Pentium III (686)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>255</td><td>2005 Bernstein</td></tr>
-<tr><td>no</td><td>835530</td><td>Pentium II (652)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>837000</td><td>Pentium III</td><td>2^163</td><td>NIST B-163</td><td>326</td><td>155</td><td>2003 Fong Hankerson Lopez Menezes</td></tr>
-<tr><td>no</td><td>943244</td><td>Pentium 4 (f05)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>yes</td><td><a href="speed-20050915-frobenius.txt">957904</a></td><td>Pentium 4 (f12)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>255</td><td>2005 Bernstein</td></tr>
-<tr><td>no</td><td>985097</td><td>Pentium (525)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>1019027</td><td>PowerPC RS64-III</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>1120824</td><td>Pentium (525)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>1166080</td><td>PowerPC RS64-III</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>1170368</td><td>PowerPC 7410</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>1200000</td><td>Pentium II</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
-<tr><td>no</td><td>1200000</td><td>Pentium II</td><td>2^233</td><td>NIST K-233</td><td>466</td><td>225</td><td>1999 Lopez Dahab</td></tr>
-<tr><td>no</td><td>1355344</td><td>PowerPC 7410</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>224</td><td>2001 Bernstein</td></tr>
-<tr><td>no</td><td>1200000</td><td>UltraSPARC</td><td>2^163</td><td></td><td>326</td><td>155</td><td>1998 Certicom</td></tr>
-<tr><td>no</td><td>1720000</td><td>Pentium III</td><td>2^233</td><td>NIST B-233</td><td>466</td><td>225</td><td>2003 Fong Hankerson Lopez Menezes</td></tr>
-<tr><td>no</td><td>1800000</td><td>Pentium</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
-<tr><td>no</td><td>2300000</td><td>UltraSPARC</td><td>2^160-2933</td><td></td><td>320</td><td>160</td><td>1998 Cohen Miyaji Ono</td></tr>
-<tr><td>no</td><td>2700000</td><td>Pentium 4</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>224</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
-<tr><td>no</td><td>3100000</td><td>Pentium</td><td>(2^31-1)^6</td><td></td><td>372</td><td>183</td><td>1999 Bailey Paar</td></tr>
-<tr><td>no</td><td>3600000</td><td>UltraSPARC</td><td>2^192-3345</td><td></td><td>384</td><td>192</td><td>1998 Cohen Miyaji Ono</td></tr>
-<tr><td>no</td><td>4100000</td><td>UltraSPARC</td><td>2^163</td><td></td><td>326</td><td>155</td><td>1999 Lopez Dahab</td></tr>
-<tr><td>no</td><td>4200000</td><td>Pentium Pro</td><td>near 2^192</td><td></td><td>384</td><td>192</td><td>1998 De Win, Bosselaers, Vanderberghe, De Gersem</td></tr>
-<tr><td>no</td><td>4800000</td><td>UltraSPARC</td><td>2^191</td><td></td><td>382</td><td>173</td><td>1999 Lopez Dahab</td></tr>
-<tr><td>no</td><td>5100000</td><td>UltraSPARC</td><td>2^224-1025</td><td></td><td>448</td><td>224</td><td>1998 Cohen Miyaji Ono</td></tr>
+<tr><td>no</td><td>500000</td><td>Alpha 21264</td><td>(2^61-1)^3</td><td></td><td>366</td><td>2^90 additions</td><td>1999 Kobayashi Morita Kobayashi Horito</td></tr>
+<tr><td>no</td><td>580000</td><td>Pentium II</td><td>2^163</td><td>NIST K-163</td><td>326</td><td>2^77 additions</td><td>2000 Hankerson Hernandez Menezes</td></tr>
+<tr><td>no</td><td>595537</td><td>Athlon (642)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>610000</td><td>Pentium III</td><td>2^163</td><td></td><td>326</td><td>2^77 additions</td><td>2001 Harley</td></tr>
+<tr><td>yes</td><td><a href="speed-20050915-thoth.txt">624786</a></td><td>Athlon (622)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>2^125 additions</td><td>2005 Bernstein</td></tr>
+<tr><td>yes</td><td><a href="speed-20050915-whisper.txt">640838</a></td><td>Pentium M (695)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>2^125 additions</td><td>2005 Bernstein</td></tr>
+<tr><td>no</td><td>650000</td><td>Alpha 21264</td><td>(2^61-1)^3</td><td></td><td>366</td><td>2^90 additions</td><td>1999 Bailey Paar</td></tr>
+<tr><td>no</td><td>668566</td><td>UltraSPARC II</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>678633</td><td>Athlon (642)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>724776</td><td>Pentium III (672)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>726922</td><td>Pentium III (686)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>734731</td><td>Pentium II (652)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>780000</td><td>Pentium II</td><td>2^192-2^64+1</td><td>NIST P-192</td><td>384</td><td>2^96 additions</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
+<tr><td>no</td><td>780000</td><td>Pentium II</td><td>(2^31-1)^6</td><td></td><td>372</td><td>2^91 additions</td><td>1999 Kobayashi Morita Kobayashi Horito</td></tr>
+<tr><td>no</td><td>785900</td><td>UltraSPARC II</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>823862</td><td>Pentium III (672)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>826955</td><td>Pentium III (686)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>827360</td><td>Pentium 4 (f05)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>yes</td><td><a href="speed-20050915-silverton.txt">832457</a></td><td>Pentium III (686)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>2^125 additions</td><td>2005 Bernstein</td></tr>
+<tr><td>no</td><td>835530</td><td>Pentium II (652)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>837000</td><td>Pentium III</td><td>2^163</td><td>NIST B-163</td><td>326</td><td>2^77 additions</td><td>2003 Fong Hankerson Lopez Menezes</td></tr>
+<tr><td>no</td><td>943244</td><td>Pentium 4 (f05)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>yes</td><td><a href="speed-20050915-frobenius.txt">957904</a></td><td>Pentium 4 (f12)</td><td>2^255-19</td><td>Curve25519</td><td>255</td><td>2^125 additions</td><td>2005 Bernstein</td></tr>
+<tr><td>no</td><td>985097</td><td>Pentium (525)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>1019027</td><td>PowerPC RS64-III</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>1120824</td><td>Pentium (525)</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>1166080</td><td>PowerPC RS64-III</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>1170368</td><td>PowerPC 7410</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>1200000</td><td>Pentium II</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
+<tr><td>no</td><td>1200000</td><td>Pentium II</td><td>2^233</td><td>NIST K-233</td><td>466</td><td>2^112 additions</td><td>1999 Lopez Dahab</td></tr>
+<tr><td>no</td><td>1355344</td><td>PowerPC 7410</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>224</td><td>2^112 additions</td><td>2001 Bernstein</td></tr>
+<tr><td>no</td><td>1200000</td><td>UltraSPARC</td><td>2^163</td><td></td><td>326</td><td>2^77 additions</td><td>1998 Certicom</td></tr>
+<tr><td>no</td><td>1720000</td><td>Pentium III</td><td>2^233</td><td>NIST B-233</td><td>466</td><td>2^112 additions</td><td>2003 Fong Hankerson Lopez Menezes</td></tr>
+<tr><td>no</td><td>1800000</td><td>Pentium</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
+<tr><td>no</td><td>2300000</td><td>UltraSPARC</td><td>2^160-2933</td><td></td><td>320</td><td>2^80 additions</td><td>1998 Cohen Miyaji Ono</td></tr>
+<tr><td>no</td><td>2700000</td><td>Pentium 4</td><td>2^224-2^96+1</td><td>NIST P-224</td><td>448</td><td>2^112 additions</td><td>2000 Brown Hankerson Hernandez Menezes</td></tr>
+<tr><td>no</td><td>3100000</td><td>Pentium</td><td>(2^31-1)^6</td><td></td><td>372</td><td>2^91 additions</td><td>1999 Bailey Paar</td></tr>
+<tr><td>no</td><td>3600000</td><td>UltraSPARC</td><td>2^192-3345</td><td></td><td>384</td><td>2^96 additions</td><td>1998 Cohen Miyaji Ono</td></tr>
+<tr><td>no</td><td>4100000</td><td>UltraSPARC</td><td>2^163</td><td></td><td>326</td><td>2^77 additions</td><td>1999 Lopez Dahab</td></tr>
+<tr><td>no</td><td>4200000</td><td>Pentium Pro</td><td>near 2^192</td><td></td><td>384</td><td>2^96 additions</td><td>1998 De Win, Bosselaers, Vanderberghe, De Gersem</td></tr>
+<tr><td>no</td><td>4800000</td><td>UltraSPARC</td><td>2^191</td><td></td><td>382</td><td>2^86 additions</td><td>1999 Lopez Dahab</td></tr>
+<tr><td>no</td><td>5100000</td><td>UltraSPARC</td><td>2^224-1025</td><td></td><td>448</td><td>2^112 additions</td><td>1998 Cohen Miyaji Ono</td></tr>
 <tr><td>no</td><td>7500000</td><td>Pentium II</td><td>2^176</td><td></td><td>352</td><td>?</td><td>1999 Aydos Savas Koc</td></tr>
-<tr><td>no</td><td>7700000</td><td>UltraSPARC</td><td>2^239</td><td></td><td>478</td><td>231</td><td>1999 Lopez Dahab</td></tr>
+<tr><td>no</td><td>7700000</td><td>UltraSPARC</td><td>2^239</td><td></td><td>478</td><td>2^115 additions</td><td>1999 Lopez Dahab</td></tr>
 <tr><td>no</td><td>9600000</td><td>Pentium</td><td>2^176</td><td></td><td>352</td><td>?</td><td>1996 De Win, Mister, Preneel, Wiener</td></tr>
-<tr><td>no</td><td>10000000</td><td>Pentium Pro</td><td>2^191</td><td></td><td>382</td><td>183</td><td>1998 De Win, Bosselaers, Vanderberghe, De Gersem</td></tr>
+<tr><td>no</td><td>10000000</td><td>Pentium Pro</td><td>2^191</td><td></td><td>382</td><td>2^91 additions</td><td>1998 De Win, Bosselaers, Vanderberghe, De Gersem</td></tr>
 <tr><td>no</td><td>11800000</td><td>Alpha</td><td>2^176</td><td></td><td>352</td><td>?</td><td>1998 Guajardo Paar</td></tr>
-<tr><td>no</td><td>12800000</td><td>Pentium</td><td>2^177</td><td></td><td>354</td><td>169</td><td>1996 De Win, Mister, Preneel, Wiener</td></tr>
+<tr><td>no</td><td>12800000</td><td>Pentium</td><td>2^177</td><td></td><td>354</td><td>2^84 additions</td><td>1996 De Win, Mister, Preneel, Wiener</td></tr>
 </table>
 </body>
 </html>
diff -ru .old-crypto/ecdh.html cr.yp.to/ecdh.html
--- .old-crypto/ecdh.html	2005-09-19 10:37:20.000000000 -0400
+++ cr.yp.to/ecdh.html	2005-09-20 06:38:40.000000000 -0400
@@ -7,6 +7,7 @@
 <h1>A state-of-the-art Diffie-Hellman function</h1>
 <a href="#use">How do I use Curve25519 in my own software?</a>
 <br><a href="#details">Technical details: the Curve25519 function</a>
+<br><a href="#papers">Where can I learn more about Curve25519?</a>
 <hr>
 <a href="ecdh/reports.html">Speed reports for elliptic-curve cryptography</a>
 <hr>
@@ -140,5 +141,10 @@
 0,
 -1,
 and infinity.
+<h2><a name="papers">Where can I learn more about Curve25519?</a></h2>
+I've given a talk on Curve25519 at ECC 2005:
+<a href="talks.html#2005.09.20">2005.09.20</a>.
+I've also given a short talk discussing the 255-bit security level:
+<a href="talks.html#2005.09.19">2005.09.19</a>.
 </body>
 </html>