Re: [TLS] Comparative cipher suite strengths

[Daniel Brown <[e-mail]>]

Paul,

Yes, I certainly ignored many parts of SP 800-57.  I'm sorry about that.

But I don't want to also ignore other parts of SP 800-57 (Revision, March 2007) such as Table 4 column heading: "Algorithm security lifetime", which also appears in the Glossary defined as "The estimated time period during which data protected by a specific algorithm remains secure".  Further on, SP 800-57 makes requirements based on Table 4, "Algorithms or key sizes not indicated for a given range of years shall not be used to protect information during that time period."  (My personal interpretation of this is that 2048-bit FFC is not to be used for data needing protection beyond 2030 under SP 800-56 compliance, but I could be completely wrong, and I have not found a more direct quote to support this.)

SP 800-57 does not provide rationale for this requirement, does it?  Is it unreasonable to speculate NIST's rationale, if only as a less dry way to discuss purely objective arguments, such as Eric's, about recommendations such as Table 4, and their wider applicability to TLS users and people not bound by SP 800-57 but who might appreciate following its guidance, especially given the question about incomparable algorithm security levels over which this thread began?

Best regards,

	Dan

-----Original Message-----
From: Paul Hoffman [mailto:[e-mail]] 
Sent: Thursday, April 23, 2009 2:00 PM
To: Daniel Brown; Eric Rescorla
Cc: '[e-mail]'
Subject: Re: [TLS] Comparative cipher suite strengths

At 1:13 PM -0400 4/23/09, Daniel Brown wrote:
>Table 4, provides a list of algorithm security lifetimes,

That's your interpretation. NIST labels the table "Recommended algorithms and minimum key sizes", and precedes it with "Table 4 provides recommendations that may be used to select an appropriate suite of algorithms and key sizes for Federal Government unclassified applications." If you want to ignore that and call it "a list of algorithm security lifetimes", that's fine, but maybe don't attribute that interpretation to NIST without further backup.
>
>which I liberally interpret as saying 2^80 computations may be feasible for a concerted adversary, in 2010 and perhaps 2^112 operations may be feasible by 2030.

See above.

>... but perhaps NIST was ... or perhaps NIST was ... or perhaps NIST is ...

Another possibility is to take NIST's words as what they intended to say.


--Paul Hoffman, Director
--VPN Consortium