On Wed, 5 Sep 2001, Dominikus Scherkl wrote:
ECC does *not* affect the speed of large file encryption.
Agreed. But that's not the point.
The most convincing argument for including ECC (to me) is
having another alternative, an algorithm depending on a
completely different problem, independent to integer
factorization and discrete logarithms.
Actually it isn't independent of either integer factorization or
the discrete log problem. All of the ECC systems I've seen are actually
discrete log over the elleptic curve derived number field rather than the
one produced by "mod n". The only real difference is that no one knows
how to apply a number field sieve to the ECC. Well more accuratly, no one
knows if there exists a definition of "smoothness", thus the most
effecient factoring algorithm to date is Pollard's Rho which sets the
equivalent key strength to a much smaller multiple of RSA before Number
field seives.
So you get a faster PK encryption, that uses less memory, but only
because no one has figured out how to apply our best factoring algorithms
to it. This may not be possible, or may just not be known. Of course
, the next major advance in factoring may not even be a seive, or
require smoothness. That is why many people only recommend ECC for small
devices, but these are all if's.
73,
Shawn