Re: [TLS] Comparative cipher suite strengths

[Peter Gutmann <[e-mail]>]

[e-mail] writes:

>Therefore, in my mind, they are getting a false sense of security from using
>AES-256 as the underlying strength of the whole TLS session is determined by
>the weakest point - in this case the 1024 bit RSA keys, which NIST state to
>be equivalent to "80-bits" [when compared to a symmetric cipher I guess].

They're not getting any sense of security at all.  They initially wanted a
cipher with 128-bit encryption, because everyone knows that you have to have
128 bits to be Good.  AES encryption has the required 128 thingies, so they
went with that.

Then someone pointed out that there's a version of AES with 256 thingies
instead of 128, and if 128 is Good then 256 must be even Gooder.  So the
requirement was changed to use AES with 256 thingies.

If there was an AES with 397 thingies they'd go with that instead, because
it's obvious that that one's ever Gooderer than the one with 256 thingies.

>So, I would want to recommend to the customer that if they want a more secure
>TLS session,

They don't want a more secure TLS session, they want bigger numbers after
their algorithm name.  So the optimal approach here would be to write a draft
for a new TLS cipher suite using the McEliece cryptosystem, because then you
can use numbers bigger than anyone else.

Peter.