Re: [Cfrg] matching AES security

[Michael Hamburg <[e-mail]>]

On Jul 30, 2014, at 12:45 PM, Andy Lutomirski <[e-mail]> wrote:

> On Wed, Jul 30, 2014 at 11:24 AM, Blumenthal, Uri - 0558 - MITLL
> <[e-mail]> wrote:
>> Is the attack DJB mentioned an attack on AES?  No: AES matches the PRP
>> security definition. Is it an attack on Salsa20? No: it meets the security
>> claim.
>> 
>> Rather it's the obvious point that a man who strains half a lake has half
>> the fish.
>> 
>> This has been pointed out before on this list, and is really on the level of
>> an exercise in probability.
>> 
>> In that case (probability game) this attack does not seem realistic, let
>> alone plausible.
>> 
>> How many plaintext pairs can you store (alternatively, which one "master"
>> plaintext would you use)? For how many keys? How do various encryption modes
>> impact your ability to search your tables (i.e., might using IV interfere
>> with it)? How are you planning to identify that magic plaintext encryption
>> in the traffic stream? What do your resulting probabilities look like in
>> real world, after all of this has been taken into account?
>> 
>> I won't dump my AES-128 just yet. :-)
> 
> In my opinion, this approach to crypto has been inappropriate for
> quite some time.  Despite the fact that, theoretically, there were
> nice attacks against MAC-then-encrypt, people kept using it because
> they couldn't imagine how those attacks could work in the "real
> world".  That didn't go so well.
> 
> If people start using 256-bit keys, then these attacks are a
> non-issue.  Or someone could try to find a protocol that is *provably*
> immune with 128-bit keys.  But let's stop relying on our own failures
> to image how these attacks might work.
> 
> —Andy

I’s really hard to get tight security bounds.  To start with, you’ll need something stronger than the standard PRF/PRP assumptions; maybe ideal ciphers would be enough?  Likewise with EC signatures, even in the ROM the bounds are really far from tight.

But yeah, 256-bit symmetric ciphers are cheap.  If the small performance difference doesn’t matter much to you, then just use them everywhere.

— Mike