Re: [Cfrg] A little room for AES-192 in TLS?

["Salz, Rich" <[e-mail]>]

> How about a scenario where an adversary is able to compromise the
> software in such a way that related keys are being generated occasionally
> and possibly even used for encryption of known plain text (protocol headers
> come to mind)?

To the best of my knowledge, partial compromise of software is not something that has been in the IETF threat model.  "All or nothing" if you will.

> And how can one extrapolate the attacks and analyses mentioned in
> http://eprint.iacr.org/2009/317 to use them as an indication of possible
> cryptanalytic advances?

One simple idea, which I have suggested in the TLS mailing list, is that you search to see if anyone has done anything in this area in the past eight years.
 
> > used almost exclusively. I think the general trend is to switch to
> > AES-256 in new systems.
> 
> This is a circular argument.

Not quite.  It is an argument saying that we are using AES256 in spite of what one paper says.

> I don't see how one can qualify the addition
> of a few references to a list as "complex".

Have you done much software deployment, especially at Internet scale?  This is about far more than just adding IANA entries.  Did you see my post in the  TLS group that talked to this?
 
> So the question remains if AES-192 has certain characteristics that warrant
> inclusion. The fact that "the key schedule for 256-bit version is pretty lousy"
> and the mentioned attacks have complexity of < 2^100 for AES-256, but >
> 2^179 for AES-192 might speak for it.

Has anyone but Bruce shared that viewpoint?

It's been nine years.  Surely *something* must have happened that you can find?