Re: [sasl] MOGGIES Proposed Charter

[Tom Yu <[e-mail]>]

Nicolas Williams <[e-mail]> writes:

> On Fri, May 21, 2010 at 12:38:22AM +0200, Martin Rex wrote:
>
>> What changes over time is the amount of "strength" that one considers
>> secure.  
>
> Not only.  Cryptanalysis progresses and the relative strengths of
> various algorithms can vary.
>
> I abhor anything remotely like a quantification of cryptographic
> strength, and will for the forseeable future.

The meaning of "security strength" can be made fairly precise by
definitions involving, for example, the base 2 logarithm of the time
or space complexity of attacking an algorithm, e.g., NIST SP 800-57,
Part 1, Section 5.6.1.  That text gives the example of three-key
triple DES, which has 168 bits of key material and has 112 bits of
effective security strength.

Yes, this means that you may have to revise the numeric "security
strength" that you report for a given cryptographic association as new
cryptanalytic attacks are discovered, but you would have to do that
anyway with a non-numeric method of reporting "security strength".

As I understand it, defeating an algorithm with a security strength of
128 bits approaches or exceeds reasonable information-theoretic bounds
on the computational capacity of the universe, unless you consider
quantum computing to be a credible threat.  I expect that the amount
of "strength" that we consider secure is unlikely to change unless
tremendous advances occur in the realm of quantum computing.