Re: [TLS] Comparative cipher suite strengths

How about this: US Government (yes, the one you seem to like rather less than the other governments) has declared that AES-128 can be used to protect information up to SECRET level, and for TOP SECRET one must use AES-256. Apparently they weren't aware of Eric's views regarding the unnecessariness of 256 bits when you have a perfectly good 128-bit key-space, and can't truly-really guarantee the algorithm strength anyway.

They did not mandate (nor even define) AES-397 or 398 as of yet, obviously because crypto scientists who work for them are not as smart or sarcastic as we are here.

So the optimal approach here would be to find out the real need of the customer - for what purpose he's trying to go to a higher-level encryption standard - and address it in practical matter (i.e. 15K RSA keys, while theoretically matching, are hardly usable in practice - so something bigger than 1K or 2K, but still wield-able; or follow Suite B and use ECC - in that case you can achieve the ballpark key size match between the algorithms).

Though where that customer is going to get a reasonably bug-free implementation is beyond me. I concede this point.

You can also point out to your customer that AES-128 is indeed considered "good enough" for most of the "normal" applications. But if he's already set his encryption policy, you probably won't get very far.
--
Regards,
Uri
<Disclaimer>

On 4/23/09  03:06 , "Peter Gutmann" <pgut001@cs.auckland.ac.nz> wrote:

carlyoung@keycomm.co.uk writes:

>Therefore, in my mind, they are getting a false sense of security from using
>AES-256 as the underlying strength of the whole TLS session is determined by
>the weakest point - in this case the 1024 bit RSA keys, which NIST state to
>be equivalent to "80-bits" [when compared to a symmetric cipher I guess].

They're not getting any sense of security at all.  They initially wanted a
cipher with 128-bit encryption, because everyone knows that you have to have
128 bits to be Good.  AES encryption has the required 128 thingies, so they
went with that.

Then someone pointed out that there's a version of AES with 256 thingies
instead of 128, and if 128 is Good then 256 must be even Gooder.  So the
requirement was changed to use AES with 256 thingies.

If there was an AES with 397 thingies they'd go with that instead, because
it's obvious that that one's ever Gooderer than the one with 256 thingies.

>So, I would want to recommend to the customer that if they want a more secure
>TLS session,

They don't want a more secure TLS session, they want bigger numbers after
their algorithm name.  So the optimal approach here would be to write a draft
for a new TLS cipher suite using the McEliece cryptosystem, because then you
can use numbers bigger than anyone else.

Peter.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls