Re: [Cfrg] A little room for AES-192 in TLS?

[Leonard den Ottolander <[e-mail]>]

On Sun, 2017-01-15 at 20:59 +0000, Taylor R Campbell wrote: 
> Only very unusual protocols ever use related keys.  In sensible
> protocols, every key is drawn independently uniformly at random.

Protocols that are designed to use related keys? I hope not!

Compare http://eprint.iacr.org/2009/317 4.1 Related-key attack model:

"Compared to other cryptanalytic attacks in which the attacker can manipu-
late only the plaintexts and/or the ciphertexts the choice of the relation between
secret keys gives additional degree of freedom to the attacker. The downside of
this freedom is that such attacks might be harder to mount in practice. Still,
designers usually try to build "ideal" primitives which can be automatically used
without further analysis in the widest possible set of applications, protocols, or
modes of operation. Thus resistance to such attacks is an important design goal
for block ciphers, and in fact it was one of the stated design goals of the Rijndael
algorithm, which was selected as the Advanced Encryption Standard."

So the question remains if indeed AES-192 is inherently more resistant
to this kind of attack (more of an "ideal primitive" in this respect)
than AES-256 or do I read too much in the remark "the key schedule of
AES-192 has better diffusion" in 6 Attack on AES-192?

Regards,
Leonard.

-- 
mount -t life -o ro /dev/dna /genetic/research