FAQ change, final draft

[Robert J. Hansen]

> logarithmically in key strength. So yes, a switch to ECC would be equivalent to
> much larger RSA keys. I'm not sure, but didn't discrete-logarithm keys scale
> roughly equivalently to RSA? I think so, but I'm not sure...

Yes.  The general consensus is that the discrete logarithm problem is 
harder than integer factorization, so ELG/DSA will provide more strength 
than RSA for a given length.

However, I've also been cautioned by some big names in crypto that I 
shouldn't put too much stock in this: we know DLP must be at least as 
hard as integer factorization, but we don't have precise numbers for how 
much harder it has to be, and the tendency over the years has been for 
the two to slowly converge in difficulty.

As of now the best guidance is to think DLP is at least as hard as IFP, 
but to be skeptical about how much harder.