Re: [Cfrg] matching AES security

[Natanael <[e-mail]>]

Den 30 jul 2014 16:06 skrev "Robert Moskowitz" <[e-mail]>:
>
>
> On 07/30/2014 08:33 AM, D. J. Bernstein wrote:
>>
>> Blumenthal, Uri - 0668 - MITLL writes:
>>>
>>> IMHO, the logic/reason of matching security levels of the
>>> cryptographic algorithms employed in a protocol suite is fairly
>>> obvious and does not need an explicit justification.
>>
>> Let's think through what "matching security levels" actually means for
>> matching elliptic curves with AES.
>>
>> In the foreseeable future there will be billions of devices that users
>> are relying on for cryptographic computations, and it's easy to imagine
>> that a typical device will use at least one new key every minute, i.e.,
>> a million new keys within two years. That's more than 2^50 keys overall.
>
>
> Dan,
>
> Please explain what typical device will use at least one new key every
minute?
>
> In the typical devices I work with there will be at best one ECDHE
exchange per day. Sometimes only once per month. (one message/5min = 312
short messages/day to protect with AES-CCM or GCM). (we are working on
changing once per life of sensor)
>
> Now if you look at the server side that is receiving messages from 10,000
fielded sensors and thus has 10,000 ECDHE exchanges/day (or per month),
then the risk is a tad different?

It is not inconceivable that all kinds of mobile devices (not just
smartphones, but smartglasses, watches, shoes, your backpack, home
automation devices, electric cars which talk with every other large vehicle
nearby, etc) will be part of traffic anonymization networks like Tor and
I2P which frequently establishes new encrypted tunnels, that they'll be
using instant messengers with various OTR like protocols which rekey often,
so be part of radio mesh networks (see apps like Serval), etc... Then
there's file sharing (Flud is a nice torrent client for Android). And don't
forget randomized cover traffic to disrupt traffic analysis.

That's not even considering home servers which will do all of the above and
much more.

Few devices will only maintain a small set of connections over their
lifetimes, and many will be rekeying often for the sake of PFS (perfect
forward secrecy), etc...

This may be 10 years off before it becomes common (a large fraction of
users doing it), but it's highly likely to happen. The total number of
encrypted links will increase very drastically over time.

Your sensor may not be affected, but the rest of the world will be.