Bottomley: Using Elliptic Curve Cryptography with TPM2

All existing ECC standards rely on shared, fixed domain parameters. So ECC is susceptible to the same fundamental issue as most DH implementations. In a real sense it's even more susceptible as nobody is suggesting _not_ to use shared parameters, whereas best practice for DH for over 15 years has been to dynamically generate unique prime groups.

Don't think of the NSA attacks on DH as people using key sizes that were too small. Rather, the salient lesson is that when enough people are using shared parameters the economic calculus applied for choosing key sizes can be substantially impacted if you don't take account of that fact. Anybody who looked at the increase of DH usage on the Internet and the fact that almost everybody was using shared primes could have easily calculated that we were approaching (or had already passed) a point where the old cost models were outdated. But nobody thought to look; at least, nobody both looked at the evolving situation and reacted to it except the NSA and, perhaps, other secret actors.

Precomputing solutions to ECC domain parameters of popular curves may be more difficult relative to DH in terms of specific known techniques (e.g. Weil decent attacks). But there are still many unknowns. We're always going to push the envelope and risk being too optimistic when choosing key sizes because it's never free; there's always a cost+benefit tradeoff. While the highest-end processors are ridiculously powerful, the biggest growth may come from IoT devices with 1990s or 2000s era computation power.

The researcher behind Ed448 has said it's probably too conservative, so while Ed448 might be perfectly safe until the age of ubiquitous quantum computing, the vast majority of people are likely to continue using shorter keys. The margin of safety is going to be smaller than what we could theoretically accomplish, meaning we can't be as lax when it comes to understanding and continually tracking the cost+benefit model in light of real-world deployments. That's the takeaway--the NSA program showed that we were lacking in our ability to clearly and honestly reassess the economic calculus of real-world usage, and in particular identifying the systemically weak links.