Re: [Cfrg] A little room for AES-192 in TLS?

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Jan 18, 2017 at 12:12 PM, Leonard den Ottolander <
[e-mail]> wrote:

>
> - AES-192 was excluded from TLS for arbitrary reasons.
> - AES-256 has known weaknesses in its key schedule that some researcher
> consider severe.
> - AES-192 offers better security than AES-128. There is serious doubt
> AES-256 can offer the same level of security. This makes AES-192 a valid
> alternative.
> - Implementations of AES-192 are readily available.
>
>
​AES 192 was excluded for the perfectly good reason that there is no
compelling argument for inclusion.

I would like to see the number of suites reduced because the strength of a
cryptographic system depends on the strength of the weakest cipher. Thus
adding ciphers to a system invariably weakens it.

The only way to improve security is to eliminate ciphers. AES 128 is
necessary, so is AES 256. ​I have never seen a point to 192.

If the AES key schedule is bjorked, time for a new cipher comp. At one
point there was the possibility of a really fun itinerary, but the
governments that might have sponsored a non-US cipher standard are not
exactly crypto friendly right now.