Re: [Cfrg] A little room for AES-192 in TLS?

[Leonard den Ottolander <[e-mail]>]

Hello Phillip,

On Wed, 2017-01-18 at 12:53 -0500, Phillip Hallam-Baker wrote:
> On Wed, Jan 18, 2017 at 12:12 PM, Leonard den Ottolander <
> [e-mail]> wrote:
> 
> >
> > - AES-192 was excluded from TLS for arbitrary reasons.
> > - AES-256 has known weaknesses in its key schedule that some researcher
> > consider severe.
> > - AES-192 offers better security than AES-128. There is serious doubt
> > AES-256 can offer the same level of security. This makes AES-192 a valid
> > alternative.
> > - Implementations of AES-192 are readily available.
> >
> >
> ​AES 192 was excluded for the perfectly good reason that there is no
> compelling argument for inclusion.
> 
> I would like to see the number of suites reduced because the strength of a
> cryptographic system depends on the strength of the weakest cipher. Thus
> adding ciphers to a system invariably weakens it.

It appears AES-256 is a weaker link than AES-192 so your general
argument about more is less seems invalid in this case. AES-256 shows
weaknesses that are not so prominent in AES-192.

> The only way to improve security is to eliminate ciphers. AES 128 is
> necessary, so is AES 256. ​I have never seen a point to 192.

I'm trying to make exactly that point :-) . AES-192 does not suffer from
the same weaknesses as AES-256 so the former is probably a more robust
cipher choice than the latter.

> If the AES key schedule is bjorked, time for a new cipher comp. At one
> point there was the possibility of a really fun itinerary, but the
> governments that might have sponsored a non-US cipher standard are not
> exactly crypto friendly right now.

The problems with the key schedule are with AES-256 specifically. Not
with AES in general.

I forgot to mention that AES-192 profits from the hardware support (CPU
AES instructions) that exist. This is not (yet) true for new ciphers.

Regards,
Leonard.

-- 
mount -t life -o ro /dev/dna /genetic/research