Why is the NSA deprecating p256 ECDHE?

If I'm understanding that paper (which I may not be as I'm skimming through it), they're specifically focusing on what the configuration should be for government/military systems.

The primary audiences for this guidance are National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) cybersecurity leaders, system administrators, and network security analysts.

My understanding is that 2048-bit RSA and 256-bit ECDHE are "roughly" equivalent in terms of difficulty to brute-force. If they're recommending going up to 3072-bit RSA, it'd make sense that they'd also suggest 384-bit ECDHE. I don't think it's anything specific to P-256 (at least, not that they'd admit), just that their requirements (for gov/mil systems) are for something higher, perhaps due to who they think might be attacking them.

It may also be the expected lifetime of the systems. I think they're hoping that it gets configured at a more secure level now so they don't need to get everybody to update again 5 to 10 years from now. It's probably similar logic to why the Let's Encrypt roots use 4096-bit RSA and P-384, since they're longer-lived systems and it's hard to predict the state of crypto a decade out.

I don't see anything specifically hinting at "We broke EC and don't use it" or the like, just that their requirements are for longer key lengths, though again I guess I could be misreading it.

4 Likes