Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Ilari Liusvaara <[e-mail]>]

On Thu, Dec 25, 2014 at 10:38:08AM +0800, Michael Clark wrote:
> On 25/12/14 9:57 am, Watson Ladd wrote:
> 
> Sorry I don't have numbers, however if you are attacking a target where
> you know the message length of a oft repeated transaction and have a
> 128-bit GCM auth tag (theoretically ~64-bits strength if you have
> captured texts) then there is a possibility you could forge auth tags.
> DHTs are fast and disks are cheap. There may be some facilities that
> have 100 million threads and more drives (if you knew Intel's order
> book). I say dictionary lookup would be feasible within the next few
> years which has to be the time domain that is considered. sha1 is being
> deprecated elsewhere. Sure people have more time to attack CA certs.

Without side-channel leakage, nonce reuse or breaking AES, you simply
don't have enough information to tell the correct answer from wrong ones
(128 bits remain arbitrary). So you can't bruteforce the keyspace
offline.

(The similar goes for Chacha20-Poly1305 (modulo Chacha20)).

-Ilari