Re: [Cfrg] A little room for AES-192 in TLS?

It seems like we need a better 256-bit algorithm than AES-256: the related
key attacks might not be a concern in TLS, but if use of AES-256 in TLS
causes its widespread use in other contexts, it will sooner or later be
used in a context where the related key attacks matter. I would support
deprecating AES-256 throughout IETF in favor of a better alternative.

It doesn't seem like AES-192 is the right choice for that alternative.
Among other things, it's not 256-bit :-).

What *should* CFRG be recommending as a 256-bit symmetric algorithm?

Cheers,

William

On Tue, Jan 17, 2017 at 9:48 AM, Salz, Rich <rsalz@akamai.com> wrote:

> > Are you suggesting that because this research is 8 years old its
> findings are
> > not valid?
>
> Yes, kinda.  If the sky really was falling eight years ago, then where are
> the other papers?
>
> > "The most disturbing aspect of the new attacks is that AES-256 can no
> longer
> > be considered as a safe black box construction, which can be dropped into
> > any security application with little thought about how it is used."
>
> Well, luckily, that is not the case with TLS.  The particular attack about
> keys, as has been explained, isn't relevant to AES-in-TLS.  Your
> compromise, while not only outside the typical IETF scope, has been shown
> to fail as the other side will abort the connection.
>
> > work best against AES-256 (which was supposed to be the strongest member
> > of the AES family), and do not currently seem to work against AES-128."
>
> Luckily we use AES128.
>
> > And you cannot argue nobody wants to use it as it is not available for
> use. If I
> > wanted to I could not use AES-192 except in private use scenario's as
> noone
> > is offering such ciphers, i.e.
>
> Yes.
>
> > I
> > acknowledge adding ciphers is not a zero effort, but to describe it as
> complex
> > is inaccurate.
>
> We disagree.
>
> You can write up an individual RFC that defines AES192 ciphers for use in
> TLS, and ask IANA to register them, and then "let the market decide."  I
> suggest you focus on a couple, and not try for full parity by defining a
> couple of dozen, as the registrar is likely to reject it.
>
> Or you can keep posting here (and as previously pointed out, more
> appropriately the TLS list) and see if you can convince anyone.
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>