Re: [Cfrg] A little room for AES-192 in TLS?

["Salz, Rich" <[e-mail]>]

> Are you suggesting that because this research is 8 years old its findings are
> not valid?

Yes, kinda.  If the sky really was falling eight years ago, then where are the other papers?

> "The most disturbing aspect of the new attacks is that AES-256 can no longer
> be considered as a safe black box construction, which can be dropped into
> any security application with little thought about how it is used."

Well, luckily, that is not the case with TLS.  The particular attack about keys, as has been explained, isn't relevant to AES-in-TLS.  Your compromise, while not only outside the typical IETF scope, has been shown to fail as the other side will abort the connection.

> work best against AES-256 (which was supposed to be the strongest member
> of the AES family), and do not currently seem to work against AES-128."

Luckily we use AES128.

> And you cannot argue nobody wants to use it as it is not available for use. If I
> wanted to I could not use AES-192 except in private use scenario's as noone
> is offering such ciphers, i.e.

Yes.

> I
> acknowledge adding ciphers is not a zero effort, but to describe it as complex
> is inaccurate.

We disagree.

You can write up an individual RFC that defines AES192 ciphers for use in TLS, and ask IANA to register them, and then "let the market decide."  I suggest you focus on a couple, and not try for full parity by defining a couple of dozen, as the registrar is likely to reject it.

Or you can keep posting here (and as previously pointed out, more appropriately the TLS list) and see if you can convince anyone.