Re: [TLS] Comparative cipher suite strengths

[Eric Rescorla <[e-mail]>]

At Tue, 21 Apr 2009 16:32:54 +0100,
Carl Young wrote:
> 
> Hi,
> 
> Can anyone point me to any documentation or information detailing the 
> relevant strengths of cipher suites within TLS 1.x. I was wondering as the 
> NIST publishes relevant key strengths - where a 1024 bit RSA key is assumed 
> to provide an equivalence of 80 bits of security [SP800-57, part 1]; 3TDEA 
> is 112 bits.
> 
> So, for TLS_RSA_WITH_3DES_EDE_CBC_SHA, assuming an RSA 1024 bit key-pair, 
> would the effective strength of the connection be 80 bits or am I looking to 
> compare apples and oranges?
>
> If I want to negotiate AES-256, should I really be using a 15360 bit RSA key 
> or, again, am I looking at this in the wrong way?

Well, I think that this last bit is certainly looking at it the wrong
way. We don't know of any conditions under which AES-256 would be
breakable and AES-128 would not be, so talking about "key strength"
just doesn't make much sense at that level.

-Ekr