Re: [Cfrg] A little room for AES-192 in TLS?

[Phillip Hallam-Baker <[e-mail]>]

Please no, just no.

Use 128 bit AES or 256 bits. Please do not create more options. The idea
that there is a need for a cipher between 10 and 14 rounds is just not
sensible. Either you are on the bleeding edge or you take a 40% performance
hit.

I am now of the opinion that all Key Agreement schemes should use a Key
Derivation function, RSA included. So even if your Key Agreement only
delivers 128 bits worth of work factor, you can still use a 256 bit cipher.

If you are doing a master key agreement plus an ephemeral, you should use
the master key agreement to salt the key derivation and so even with 128
bits of work factor on each you will have a total of 256 bits.

Rather than add pointless new cipher suites, I would like to see the key
derivation function fixed so that the ephemeral step cannot weaken the
strength of the agreed key.