Re: [TLS] Comparative cipher suite strengths

[Eric Rescorla <[e-mail]>]

At Wed, 22 Apr 2009 09:24:26 -0400,
Blumenthal, Uri wrote:
> 
> Eric,
> 
> I disagree. You're mixing together two orthogonal issues: security
> of algorithms and security of implementation.
> 
> NIST recommends that algorithms in a cipher suite are of comparable
> strength. That includes relative key length.

I appreciate that NIST recommends this. I think it's silly.
It doesn't get any less silly because it's typeset in cool
FIPS formatting.


> The fact that despite of using secure algorithms your implementation
> still can have exploitable bugs (that nullify the benefits of
> cryptography) is 100% irrelevant to the issue of selecting
> algorithms and their parameters.

I don't agree that that's true, but in any case it's not what I'm saying.

The amount of computational power required to break a 128-bit AES
key with current is so outlandishly large that there is plausible
scenario that such a key will be broken by brute force. The 
only plausible situations in which 128-bit AES keys are breakable,
then, are non-brute-force attacks such as attacks on the implementation
or an analytic attack. In neither case does 2^{128} represent
an accurate estimate of the security of the algorithm, nor is
there any reason to believe that AES-256 is 2^{128} times more
secure under such attacks. Thus, the inference that one ought to
use an RSA key that is 2^{128} times stronger with AES-256 than
AES-128 also does not follow.


-Ekr