Re: [Cfrg] A little room for AES-192 in TLS?

[Ilari Liusvaara <[e-mail]>]

On Mon, Jan 16, 2017 at 08:07:31PM +0100, Leonard den Ottolander wrote:
> Hello Tony,
> 
> On Mon, 2017-01-16 at 10:09 -0800, Tony Arcieri wrote:
> > I would rate the chances of a related key attack against TLS as
> > "vanishingly small". The use of key derivation functions ensures keys will
> > not be related.
> 
> How about a scenario where an adversary is able to compromise the
> software in such a way that related keys are being generated
> occasionally and possibly even used for encryption of known plain text
> (protocol headers come to mind)? This scenario is assuming the adversary
> is not fully in control of the source code but is capable to inject
> subtle bugs "under the radar". Would AES-192 hold up better in such a
> scenario than AES-256?

The key derivations are interop-critical, so compromises like that would
be found real quick (since essentially nothing would work anymore).
 

And there is at least one place in TLS 1.2 that can be undetectably
compromised by a server in a way that lets adversary passively decrypt
most connections.


-Ilari