Re: [TLS] Comparative cipher suite strengths

While this certainly makes a nice tea-table story, I question the "historical truthfulness" of it.

YOU may need to explain things to YOUR customers (and make them understand), lest they feel mistreated and go to another vendor. I don't think USG agencies have the same luxury of choosing their own crypto policy provider and product approver! The pressure usually is applied the other way (the "other" agency says "we want/need this", and the "crypto" branch responds "nonetheless you shall use that, and we cannot reveal to you why").

P.S. AES competition had entries with variable key sizes, I think up to 512 bits. Did it look bad - selecting an algorithm with lower maximum key length? No agency complained loud enough for us to hear, I guess?

P.P.S. If you choose so, you can define AES with independent subkeys, using PRNG to generate keys for each round from a given seed of any length you select (say 302 bits?).  :-)

P.P.P.S. KGB's encryption standard - "GOST" - was released in 1981 or 1983 (internally!) for "sensitive but unclassified" data and had 256-bit key. Design allowed independent subkeys of 512 bits (if memory serves me). And that's on a 64-bit block cipher...

On 5/2/09  05:40 , "Peter Gutmann" <pgut001@cs.auckland.ac.nz> wrote:

Bill Frantz <frantz@pwpconsult.com> writes:

>When I think of the reasons that NSA/DOD could have for requiring AES-128 for
>secret and AES-192 for top secret, I think they may be looking at the whole
>cryptographic system.

They're also looking at the whole political system.  During a discussion among
crypto geeks some years ago someone from some branch of the USG involved with
crypto said that they were under a lot of pressure from govt-agency consumers
of crypto who were used to commercial products with keys that went up to 10,
11, and 12.  Having a single key size of (say) 128 bits would look bad when
those same govt-agency consumers could go out and buy commercial products that
were obviously stronger than the proposed government standard because they had
larger numbers behind the algorithm name.  So although there wasn't any
immediate technical reason to use larger keys, if there wasn't a capability in
AES for keys to go to 11 or 12 then it would look bad compared to non-govt-
approved crypto.

I don't know how much influence that had on the final decision, but given the
choice between having to explain for the rest of my life to one govt.agency
after another that 128 bits is good enough, and simply letting them choose
keys that go to 11 if it makes them feel better, I know which one I'd choose.

Peter.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--
Regards,
Uri
<Disclaimer>