Re: [TLS] Comparative cipher suite strengths

[Peter Gutmann <[e-mail]>]

Bill Frantz <[e-mail]> writes:

>When I think of the reasons that NSA/DOD could have for requiring AES-128 for
>secret and AES-192 for top secret, I think they may be looking at the whole
>cryptographic system.

They're also looking at the whole political system.  During a discussion among
crypto geeks some years ago someone from some branch of the USG involved with
crypto said that they were under a lot of pressure from govt-agency consumers
of crypto who were used to commercial products with keys that went up to 10,
11, and 12.  Having a single key size of (say) 128 bits would look bad when
those same govt-agency consumers could go out and buy commercial products that
were obviously stronger than the proposed government standard because they had
larger numbers behind the algorithm name.  So although there wasn't any
immediate technical reason to use larger keys, if there wasn't a capability in
AES for keys to go to 11 or 12 then it would look bad compared to non-govt-
approved crypto.

I don't know how much influence that had on the final decision, but given the
choice between having to explain for the rest of my life to one govt.agency
after another that 128 bits is good enough, and simply letting them choose
keys that go to 11 if it makes them feel better, I know which one I'd choose.

Peter.