Re: [TLS] Comparative cipher suite strengths

[Bill Frantz <[e-mail]>]

[e-mail] (Nicolas Williams) on Thursday, April 23, 2009 wrote:

>The more likely explanation is that *some* imaginable
>cryptanalytic advances could reduce the effective strength of AES in
>such a way that longer keys remain more secure than shorter keys.

When I think of the reasons that NSA/DOD could have for requiring AES-128
for secret and AES-192 for top secret, I think they may be looking at the
whole cryptographic system. While symmetric cyphers have some solid math
behind them, other parts of the system, such as generating random numbers
for the keys are frequently more akin to black magic.

If my random numbers were only 75% random against some attack, with AES-192
I would still have 128 bits of strength against a brute force attack. With
AES-128, I'd only have 96 bits, and I would be quite concerned when
protecting top secret data.

Cheers - Bill

---------------------------------------------------------------------------
Bill Frantz        |"After all, if the conventional wisdom was working, the
408-356-8506       | rate of systems being compromised would be going down,
www.periwinkle.com | wouldn't it?" -- Marcus Ranum