Re: [Cfrg] A little room for AES-192 in TLS?

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Jan 18, 2017 at 1:11 PM, Leonard den Ottolander <
[e-mail]> wrote:

> Hello Phillip,
>
> On Wed, 2017-01-18 at 12:53 -0500, Phillip Hallam-Baker wrote:
> > On Wed, Jan 18, 2017 at 12:12 PM, Leonard den Ottolander <
> > [e-mail]> wrote:
> >
> > >
> > > - AES-192 was excluded from TLS for arbitrary reasons.
> > > - AES-256 has known weaknesses in its key schedule that some researcher
> > > consider severe.
> > > - AES-192 offers better security than AES-128. There is serious doubt
> > > AES-256 can offer the same level of security. This makes AES-192 a
> valid
> > > alternative.
> > > - Implementations of AES-192 are readily available.
> > >
> > >
> > ​AES 192 was excluded for the perfectly good reason that there is no
> > compelling argument for inclusion.
> >
> > I would like to see the number of suites reduced because the strength of
> a
> > cryptographic system depends on the strength of the weakest cipher. Thus
> > adding ciphers to a system invariably weakens it.
>
> It appears AES-256 is a weaker link than AES-192 so your general
> argument about more is less seems invalid in this case. AES-256 shows
> weaknesses that are not so prominent in AES-192.
> ​\
>
​
Oh really, the work fact of AES 256 is lower than that of AES 192? Please
show me the paper.

If AES 256 falls then AES goes completely. There is no middle ground.


​
> > The only way to improve security is to eliminate ciphers. AES 128 is
> > necessary, so is AES 256. ​I have never seen a point to 192.
>
> I'm trying to make exactly that point :-) . AES-192 does not suffer from
> the same weaknesses as AES-256 so the former is probably a more robust
> cipher choice than the latter.


​I see no evidence that the work factor of AES 256 is less than 2^192. ​