Re: [Cfrg] matching AES security

[Robert Moskowitz <[e-mail]>]

On 07/30/2014 08:33 AM, D. J. Bernstein wrote:
> Blumenthal, Uri - 0668 - MITLL writes:
>> IMHO, the logic/reason of matching security levels of the
>> cryptographic algorithms employed in a protocol suite is fairly
>> obvious and does not need an explicit justification.
> Let's think through what "matching security levels" actually means for
> matching elliptic curves with AES.
>
> In the foreseeable future there will be billions of devices that users
> are relying on for cryptographic computations, and it's easy to imagine
> that a typical device will use at least one new key every minute, i.e.,
> a million new keys within two years. That's more than 2^50 keys overall.

Dan,

Please explain what typical device will use at least one new key every 
minute?

In the typical devices I work with there will be at best one ECDHE 
exchange per day. Sometimes only once per month. (one message/5min = 312 
short messages/day to protect with AES-CCM or GCM). (we are working on 
changing once per life of sensor)

Now if you look at the server side that is receiving messages from 
10,000 fielded sensors and thus has 10,000 ECDHE exchanges/day (or per 
month), then the risk is a tad different?

thanks