Re: [TLS] Comparative cipher suite strengths

[Daniel Brown <[e-mail]>]

NIST SP 800-57, Table 2, provides a list of comparable strengths, and Table 4, provides a list of algorithm security lifetimes, which I liberally interpret as saying 2^80 computations may be feasible for a concerted adversary, in 2010 and perhaps 2^112 operations may be feasible by 2030.  

Note that Table 4 does not differentiate the lifetimes 128, 192, or 256 security, in loose agreement with, and perhaps for similar reasons to, Eric's argument that searching 2^128 keys will never be feasible.

Furthermore, adapting Eric's calculations below, to brute force 112-bit keys, assuming 80-bit keys are brute forcible today (let's just say with massive distributed computing for the sake of example), feature sizes would need to shrink to 50 * 10^{-9} * 2^{-32} =~ 1.16 * 10^{-17}, still smaller than a Hydrogen atom, but perhaps NIST was accounting for the possibility of some future technical developments leading to continued or even accelerated increase in processing power, or perhaps NIST was also accounting for some degradation in the security of the TDEA aglorithm below that of a generic block cipher, or perhaps NIST is just encouraging migration to AES. 

That all said, personally, I'm still much more reluctant to predict a decrease in the growth of processing power that has been going fairly steady (?) for some time.  Therefore, data needing long term protection, say medical information, is worth encrypting at a potentially higher security level, assuming one has the processing power and a well-established encryption algorithm to do so.  If Moore's law (liberally applied to processing power, not just feature size) stops soon enough, then using the larger keys was at worst a waste of processing power, or at best, insurance.

Best regards,

	Dan

-----Original Message-----
From: Eric Rescorla [mailto:[e-mail]] 
Sent: Thursday, April 23, 2009 9:57 AM
To: Daniel Brown
Cc: Eric Rescorla; Blumenthal, Uri; '[e-mail]'
Subject: Re: [TLS] Comparative cipher suite strengths

At Wed, 22 Apr 2009 11:51:10 -0400,
Daniel Brown wrote:
> 
> Eric,
> 
> Are you saying that 2^128 computations will never be feasible, and
> therefore, that Moore's law will stop?

I wasn't aware that that was a particularly controversial observation.

Current computers, with feature sizes of about 50 nm (50 * 10^{-9} m)
are just about fast enough to brute force a 64-bit key. So, in order
for Moore's law (which, remember, is about feature size) to get us to
128-bit keys, the feature sizes would need to shrink to 50 * 10^{-9} *
2^{-64} ~= 50 * 10^{-28}. Given that hydrogen atoms are on the order
of 10^{-10} m large, I don't think it's particularly safe to do a
straight line extrapolation of Moore's law through 18 more orders of
magnitude. Obviously, it's possible we'll learn how to construct
computers with some entirely different technology (quarks!), but
it's not like it's just a matter of giving Intel more money.

-Ekr