Re: [kitten] I-D Action: draft-ietf-kitten-aes-cts-hmac-sha2-05.txt

[Benjamin Kaduk <[e-mail]>]

On Mon, 2 Feb 2015, Michael Jenkins wrote:

> the document than say "because Suite B". I propose that the following
> paragraph be added to the Security Considerations section (8) to address
> the entire document, rather than to litter the document with in-place
> explanations:
>
> 8.2    Algorithm dimensions
>
> Although there is nothing in this document that constrains its application,

It's not entirely clear what "constraints its application" is intended to
mean here; I would prefer an alternate phrasing.

> it has been written to be consistent with common implementations of AES and
> SHA-2. The  encryption and hash algorithm sizes have been chosen to create
> a consistent level of protection, with consideration to implementation
> efficiencies. So, for instance, SHA-384, which would normally be matched to
> AES-192, is instead matched to AES-256 to leverage the fact that there are
> efficient hardware implementations of AES-256.

I wonder if there is a way to say that the combination of SHA-384 and
AES-256 as used in this document "only has 192 bits of security" (to the
extent that the concept of bits of security can even be defined).

> Would this suffice? If so, I'll generate an -06 version and upload it in
> time for Dallas.

That would be fine for me, but let's give Simo some time to reply as well.

-Ben