Re: [Cfrg] matching AES security

[Andy Lutomirski <[e-mail]>]

On Wed, Jul 30, 2014 at 11:24 AM, Blumenthal, Uri - 0558 - MITLL
<[e-mail]> wrote:
> Is the attack DJB mentioned an attack on AES?  No: AES matches the PRP
> security definition. Is it an attack on Salsa20? No: it meets the security
> claim.
>
> Rather it's the obvious point that a man who strains half a lake has half
> the fish.
>
> This has been pointed out before on this list, and is really on the level of
> an exercise in probability.
>
> In that case (probability game) this attack does not seem realistic, let
> alone plausible.
>
> How many plaintext pairs can you store (alternatively, which one "master"
> plaintext would you use)? For how many keys? How do various encryption modes
> impact your ability to search your tables (i.e., might using IV interfere
> with it)? How are you planning to identify that magic plaintext encryption
> in the traffic stream? What do your resulting probabilities look like in
> real world, after all of this has been taken into account?
>
> I won't dump my AES-128 just yet. :-)

In my opinion, this approach to crypto has been inappropriate for
quite some time.  Despite the fact that, theoretically, there were
nice attacks against MAC-then-encrypt, people kept using it because
they couldn't imagine how those attacks could work in the "real
world".  That didn't go so well.

If people start using 256-bit keys, then these attacks are a
non-issue.  Or someone could try to find a protocol that is *provably*
immune with 128-bit keys.  But let's stop relying on our own failures
to image how these attacks might work.

--Andy