Re: [TLS] Comparative cipher suite strengths

[Dean Anderson <[e-mail]>]

On Thu, 23 Apr 2009, Steven M. Bellovin wrote:

> One more point: NSA may or may not be able to speak ex cathedra on
> strength; we'll never know.  They have said publicly that they trust
> 256-bit AES a lot, and a lot more than they trust 128-bit AES.  That
> statement is *completely* unprecedented.

What's classified top secret is itself classified; and as I understand
it, so is the storage and handling of top secret materials, so I think
they shouldn't disclosed that AES256 is suitable for top secret because
that fact should be a secret that should only be known to people with
top secret clearance who handled top secret data.  Identifying the
cipher in use is part of the cryptanalysis problem, and they shouldn't
make that any easier; someone wasn't thinking.

> The really interesting question is this: what will NSA ever do, if
> they ever figure out how to crack AES-256?  Officially decertify it
> for TS use, thereby telling the world they think it's no longer that
> strong?

Easy, they can tell the top secret world that they have a better cipher,
which doesn't mean AES-256 is insecure, but only that the new cipher is
stronger.

		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000