Re: [Cfrg] matching AES security

[Tanja Lange <[e-mail]>]

Dear Bob,
> In the typical devices I work with there will be at best one ECDHE 
> exchange per day. Sometimes only once per month. (one message/5min = 312 
> short messages/day to protect with AES-CCM or GCM). (we are working on 
> changing once per life of sensor)
> 
> Now if you look at the server side that is receiving messages from 
> 10,000 fielded sensors and thus has 10,000 ECDHE exchanges/day (or per 
> month), then the risk is a tad different?
>
For every ECDHE there is a fresh AES key, so for whatever number 
of key exchanges you assume there is also an AES target. This is on
top of long-term connections that update the AES keys and devices
that use only symmetric keys. If that number is less than 2^50 then
the worry about finding AES-128 keys by chance gets smaller, but 
in any case it's significantly easier than breaking the DLP on an
elliptic curve over a field of ~256 bits (which needs 2^128 group
operations, so more than 2^140 bit operations).
 
All the best
	Tanja