Re: [TLS] Comparative cipher suite strengths

[Eric Rescorla <[e-mail]>]

At Thu, 30 Apr 2009 18:56:35 -0700,
Bill Frantz wrote:
> 
> [e-mail] (Nicolas Williams) on Thursday, April 23, 2009 wrote:
> 
> >The more likely explanation is that *some* imaginable
> >cryptanalytic advances could reduce the effective strength of AES in
> >such a way that longer keys remain more secure than shorter keys.
> 
> When I think of the reasons that NSA/DOD could have for requiring AES-128
> for secret and AES-192 for top secret, I think they may be looking at the
> whole cryptographic system. While symmetric cyphers have some solid math
> behind them, other parts of the system, such as generating random numbers
> for the keys are frequently more akin to black magic.
> 
> If my random numbers were only 75% random against some attack, with AES-192
> I would still have 128 bits of strength against a brute force attack. With
> AES-128, I'd only have 96 bits, and I would be quite concerned when
> protecting top secret data.

I don't think this lines up particularly well with how CSPRNGs
work. You start with some random seed information S which you
use to seed the CSPRNG. That seed has some number of bits of
entropy. Call it E. You then generate your cryptographic key.
No matter how long that key is, the total strength of the system
is the cost of brute-forcing S, i.e., 2^E operations. This is true
whether the symmetric cipher is 128 bits or 256 bits.

-Ekr