Re: [Cfrg] A little room for AES-192 in TLS?

Generally, I think the sense of the WG is to try to minimize the number of
ciphers/suits.

Speaking personally, what would make me be in favor of adding AES-192 would
be
some statement from CFRG that they thought that it was significantly
stronger than
AES-256. Absent that, I think it would be better to leave it out of TLS.

-Ekr

On Mon, Jan 16, 2017 at 7:59 AM, John Mattsson <john.mattsson@ericsson.com>
wrote:

> Note that there are trivial generic related-key attacks on AES-192 with #K
> = D = T = M = 2^96
>
> http://dx.doi.org/10.1080/0161-118791861749
>
> Regards,
> John
>
>
> On 2017-01-16, 15:43, "Cfrg on behalf of Leonard den Ottolander"
> <cfrg-bounces@irtf.org on behalf of leonard-lists@den.ottolander.nl>
> wrote:
>
> >On Sun, 2017-01-15 at 20:59 +0000, Taylor R Campbell wrote:
> >> Only very unusual protocols ever use related keys.  In sensible
> >> protocols, every key is drawn independently uniformly at random.
> >
> >Protocols that are designed to use related keys? I hope not!
> >
> >Compare http://eprint.iacr.org/2009/317 4.1 Related-key attack model:
> >
> >"Compared to other cryptanalytic attacks in which the attacker can manipu-
> >late only the plaintexts and/or the ciphertexts the choice of the
> >relation between
> >secret keys gives additional degree of freedom to the attacker. The
> >downside of
> >this freedom is that such attacks might be harder to mount in practice.
> >Still,
> >designers usually try to build "ideal" primitives which can be
> >automatically used
> >without further analysis in the widest possible set of applications,
> >protocols, or
> >modes of operation. Thus resistance to such attacks is an important
> >design goal
> >for block ciphers, and in fact it was one of the stated design goals of
> >the Rijndael
> >algorithm, which was selected as the Advanced Encryption Standard."
> >
> >So the question remains if indeed AES-192 is inherently more resistant
> >to this kind of attack (more of an "ideal primitive" in this respect)
> >than AES-256 or do I read too much in the remark "the key schedule of
> >AES-192 has better diffusion" in 6 Attack on AES-192?
> >
> >Regards,
> >Leonard.
> >
> >--
> >mount -t life -o ro /dev/dna /genetic/research
> >
> >
> >
> >_______________________________________________
> >Cfrg mailing list
> >Cfrg@irtf.org
> >https://www.irtf.org/mailman/listinfo/cfrg
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>