Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Yoav Nir <[e-mail]>]

> On Dec 25, 2014, at 3:01 AM, Michael Clark <[e-mail]> wrote:

<snip />

> I like the idea of >= 256 bits authentication, and the idea of the
> combination of a cipher based MAC and PRF based MAC for AES-GCM, given
> the properties of the AES-GCM CTR mode 'variant' and GHASH GF(2^128).

Why? Why do you want 256-bit or more message authentication?

There is value in making encryption and key agreement more secure. There is great value to attackers in recording a session and later breaking the encryption or the key agreement. Breaking the message authentication after the TLS session has terminated provides no value to the attacker. Messages need to be forged online for the attack to be successful. 

So bit lengths whose only justification is being future-proof for 30 years are not relevant for message authentication. Even for encryption, where there is value in after-the-fact breakage, the BCP being written in UTA recommends 128-bit AES rather than 256-bit.  ChaCha20 uses a 256-bit mostly because of the nature of the algorithm. It would not be any faster if the key was reduced to 128-bit. The same is not true for your proposals.

Yoav