[Cfrg] Parameter sizes (was: Cryptographic meta-principles)

[Paul Hoffman <[e-mail]>]

On May 23, 2012, at 7:30 AM, Igoe, Kevin M. wrote:

> 5.       Moore’s Law continually decreases an adversary’s cost to attack a system. so we must assume that eventually all parameter sizes will need to be readjusted.

This statement assumes that there are always parameter sizes, which is incorrect. SHA2-256 does not have a parameter to make its strength 300 bits; AES-128 does not have a parameter to make its strength 150 bits; and so on.

This is not just a pedantic discussion. For many cryptographic functions, you cannot make them stronger by changing parameters: you have to change algorithms. The operational cost of this is much higher than the cost of telling an administrator to change a configuration setting and then verifying that the setting was changed.

--Paul Hoffman