<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/11/2015 21:02, Alex Chen wrote:<br>
</div>
<blockquote class=" cite" id="mid_56439EB9_9070305_filemaker_com"
cite="mid:56439EB9.9070305@filemaker.com" type="cite">I see there
is a list of recommended list by NIST in
<a class="moz-txt-link-freetext" href="http://csrc.nist.gov/groups/ST/toolkit/documents/dss/NISTReCur.pdf">http://csrc.nist.gov/groups/ST/toolkit/documents/dss/NISTReCur.pdf</a>,
but it is very old (1999)
<br>
Is there a up to date list of elliptic curves approved or
recommended for government use in OpenSSL?
<br>
Is NID_X9_62_prime256v1 the strongest?
<br>
</blockquote>
<tt>First of all, it depends on *which government*, NIST is for <br>
the USA Government only, though some allied countries may have <br>
copied their decisions.<br>
<br>
Secondly, since ca. 1999, the official list has been mostly<br>
unchanged, namely those that are listed in the official NIST<br>
standard FIPS 186-2 for use with ECDSA and in NIST Special<br>
publication SP 800-56A for ECDH.<br>
<br>
So far, the public adjustments have been:<br>
<br>
2005: The official Suite B list of ciphers was published and<br>
included the P-256 and P-384 bit curves as minimum.<br>
Around the same time they made a secret Suite A list of<br>
ciphers for stuff more secret than "top secret".<br>
2015: NSA announced that they will soon start work on a new<br>
list, and that government departments should not waste<br>
taxpayers money doing the upgrade to Suite B just a few<br>
years before it becomes obsolete.<br>
However for use at this time they recommend P-384 or<br>
3072 bit RSA/DH as a good minimum while accepting the<br>
next step down (P-256 or 2048 bit RSA/DH) in already<br>
built systems.<br>
They also recommend the use of pure symmetric key<br>
solutions with strong (256 random bits) keys as the best<br>
current solution where possible.<br>
<br>
The (non-classified) current official advice can be read at<br>
<br>
<a class="moz-txt-link-freetext" href="https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml">https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml</a><br>
<br>
</tt>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="https://www.wisemo.com">https://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>