Re: [Cfrg] matching AES security

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

>>Please explain what typical device will use at least one new key every
>> minute?
>
>Er, well, smartphone apps might well poll/get pushed to that
>frequently, altogether, with a new key per-poll/push.  Sure, the
>protocol involved might not generate a new key per-event, but if the
>protocol is TLS, then it will.

Maybe... A good argument to avoid TLS. :-)

>DJB's point is that we should permit "odd" match-ups like AES-256 and
>Curve25519 _because_ AES-128 is weak in plausible scenarios.
                                          ^^^^^^^^^ :-)

There already are such "odd" match-ups, and I guess the trend is here to
stay.

But to do it because of attackers "getting _all_ of your 2^50 keys with
2^128 easy (sic!) computations"? (I guess you could convince about half of
the existing atoms in the Universe to do one computation for you, and
maybe store the result. But lookups would have to be extra! :).

>I'm having a hard time objecting to that!

:-)