Re: [TLS] Consensus call on Implicit IV for AEAD

[Ilari Liusvaara <[e-mail]>]

On Mon, Apr 06, 2015 at 09:24:09AM -0700, Martin Thomson wrote:
> On 3 April 2015 at 20:17, Brian Smith <[e-mail]> wrote:
> > a clear record of my objection to the
> > zero-padding mechanism on the mailing list,
> 
> For the record then, the objection was this:
> 
> If you are concerned that someone might spend a large amount of
> computing resources (2^60+ iterations) to gain themselves a reasonable
> chance of decrypting a randomly selected session from a similar sized
> set of sessions, pick a stronger cipher.

Which stronger cipher? AES-128 doesn't stand losing many bits before
becoming too weak, AES-192 is pretty much forgotten (I don't think it
even has codepoints) and AES-256 is seemingly being effectively
deprecated.


> There's a history of attempting to paper over perceived weaknesses in
> the crypto we use.  I get the belt and braces approach here, but I'd
> rather see us develop stronger constructions (ChaCha+Poly uses a
> longer key, for example).

So remove AES-128 entierely (MUST NOT negotiate) from 1.3?



-Ilari