Re: [MLS] Substitute AES-128-GCM with AES-256-GCM for TreeKEM

This is a good argument. Upgrading the ECDH primitive would make sense. I guess replacing P256 by P521 is somewhat straightforward, but Curve25519 is not. Ed448-Goldilocks might be a potential candidate.
So the question has shifted to: Do we want to increase the security level consistently? And is the payload increase acceptable?

I will close the PR for now.

Raphael

> On 19 Sep 2018, at 20:14, Richard Barnes <rlb@ipv.sx> wrote:
> 
> The obvious argument against this is that you don't ultimately get the benefit of the bigger key.  Since you're generating the key off of a P-256 operation, your security level to limited to 128 bits.  The only way that argument wouldn't hold is if you thought for some reason that AES-128-GCM was going to degrade faster than P-256, or if you wanted to argue that AES-128-GCM isn't really providing a 128-bit security level.
> 
> You could, of course, have a cipher suite where you upgrade everything: AES-256-GCM, P-521, SHA-512.  But in that case, the size of a message basically doubles.  Concretely: an element in a TreeKEM path has (1) a public key for the node (2) an encrypted node secret with is (2a) a public key (2b) an encrypted hash output and (2c) a GCM tag.  With the *256 suite, that comes to 178 = 65 + (65 + 32 + 16) and with the *512 suite, 346 = 133 + (133 + 64 + 16).
> 
> If other folks are keen on AES-256-GCM, I don't think there's any major harm in upgrading the P-256-based scheme to use AES-256-GCM, but I don't think there's much benefit either.  Likewise, if folks want to add a higher-security-level suite, I wouldn't be opposed, but I don't think it'll get much use.  In the Firefox TLS telemetry [1], the AES-256-GCM ciphersuites get more than 6x the use that the AES-128-GCM suites do.
> 
> --Richard
> 
> [1] https://mzl.la/2PPT1YL <https://mzl.la/2PPT1YL>
> 1 = RSA + AES-128-GCM = 55%
> 2 = ECDSA + AES-128-GCM = 18%
> 13 = ECDSA + AES-256-GCM =1%
> 14 = RSA + AES-256-GCM = 10%
> 
> On Wed, Sep 19, 2018 at 12:17 PM Raphael Robert <raphael@wire.com <mailto:raphael@wire.com>> wrote:
> I am proposing to substitute AES-128-GCM with AES-256-GCM for TreeKEM: 
> 
> https://github.com/mlswg/mls-protocol/pull/60 <https://github.com/mlswg/mls-protocol/pull/60>
> 
> There was no particular reason why AES-128-GCM was chosen initially, and there is no obvious security downside to AES-256-GCM.
> 
> Raphael
> _______________________________________________
> MLS mailing list
> MLS@ietf.org <mailto:MLS@ietf.org>
> https://www.ietf.org/mailman/listinfo/mls <https://www.ietf.org/mailman/listinfo/mls>