Re: [Cfrg] matching AES security

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Jul 30, 2014 at 12:34 PM, Tanja Lange <[e-mail]> wrote:
> Dear Bob,
>> In the typical devices I work with there will be at best one ECDHE
>> exchange per day. Sometimes only once per month. (one message/5min = 312
>> short messages/day to protect with AES-CCM or GCM). (we are working on
>> changing once per life of sensor)
>>
>> Now if you look at the server side that is receiving messages from
>> 10,000 fielded sensors and thus has 10,000 ECDHE exchanges/day (or per
>> month), then the risk is a tad different?
>>
> For every ECDHE there is a fresh AES key, so for whatever number
> of key exchanges you assume there is also an AES target. This is on
> top of long-term connections that update the AES keys and devices
> that use only symmetric keys. If that number is less than 2^50 then
> the worry about finding AES-128 keys by chance gets smaller, but
> in any case it's significantly easier than breaking the DLP on an
> elliptic curve over a field of ~256 bits (which needs 2^128 group
> operations, so more than 2^140 bit operations).


I am not keen on rekeying for the sake of it. There are security costs
as well as benefits. In particular a lot of systems have the property
that they are break once, run anywhere. Just as we now think 50
ciphers give less security than 5 as the strength is determined by the
weakest one an attacker can get the parties to use, rekeying for the
sake of it is probably a bad thing.

Forward Secrecy is a good thing of course, but generating ephemeral
keys or mix ins is not what I think of when someone says rekey. To me,
rekey implies rebuilding the authentication relationship between the
end points. Thats a lot more work.


I am working on making it possible to rekey PPE once a week because I
want to create a forcing function for usability. Security people often
think they can get users to do silly things every 90, 60 or even 30
days. But even security folk get fed up of hoops when its once a week.
But LOTS of folk got very worried about that suggestion and I agree
that it would be bad operationally. I doubt rekey more than once a
quarter is desirable, even if the whole process is transparent.

The only reason I rekey at all is because people read their mail on
mobile devices and those get lost. So rekeying is a good way to limit
exposure to that risk. But I don't plan to ever roll per device
credentials or keys. If a public key algorithm isn't good for a
billion uses without security concern, then don't use it.


AES does have slightly different concerns. But really, if you are
worried about the need to rekey then you should go to a 256 bit key
first and then think about rekeying AES.