Re: [Cfrg] A little room for AES-192 in TLS?

[John Mattsson <[e-mail]>]

Note that there are trivial generic related-key attacks on AES-192 with #K
= D = T = M = 2^96

http://dx.doi.org/10.1080/0161-118791861749

Regards,
John


On 2017-01-16, 15:43, "Cfrg on behalf of Leonard den Ottolander"
<[e-mail] on behalf of [e-mail]> wrote:

>On Sun, 2017-01-15 at 20:59 +0000, Taylor R Campbell wrote:
>> Only very unusual protocols ever use related keys.  In sensible
>> protocols, every key is drawn independently uniformly at random.
>
>Protocols that are designed to use related keys? I hope not!
>
>Compare http://eprint.iacr.org/2009/317 4.1 Related-key attack model:
>
>"Compared to other cryptanalytic attacks in which the attacker can manipu-
>late only the plaintexts and/or the ciphertexts the choice of the
>relation between
>secret keys gives additional degree of freedom to the attacker. The
>downside of
>this freedom is that such attacks might be harder to mount in practice.
>Still,
>designers usually try to build "ideal" primitives which can be
>automatically used
>without further analysis in the widest possible set of applications,
>protocols, or
>modes of operation. Thus resistance to such attacks is an important
>design goal
>for block ciphers, and in fact it was one of the stated design goals of
>the Rijndael
>algorithm, which was selected as the Advanced Encryption Standard."
>
>So the question remains if indeed AES-192 is inherently more resistant
>to this kind of attack (more of an "ideal primitive" in this respect)
>than AES-256 or do I read too much in the remark "the key schedule of
>AES-192 has better diffusion" in 6 Attack on AES-192?
>
>Regards,
>Leonard.
>
>-- 
>mount -t life -o ro /dev/dna /genetic/research
>
>
>
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>https://www.irtf.org/mailman/listinfo/cfrg