Re: [TLS] Comparative cipher suite strengths

["Steven M. Bellovin" <[e-mail]>]

On Wed, 22 Apr 2009 06:46:27 -0700
Eric Rescorla <[e-mail]> wrote:

> The amount of computational power required to break a 128-bit AES
> key with current is so outlandishly large that there is plausible
> scenario that such a key will be broken by brute force. The 
> only plausible situations in which 128-bit AES keys are breakable,
> then, are non-brute-force attacks such as attacks on the
> implementation or an analytic attack. In neither case does 2^{128}
> represent an accurate estimate of the security of the algorithm, nor
> is there any reason to believe that AES-256 is 2^{128} times more
> secure under such attacks. Thus, the inference that one ought to
> use an RSA key that is 2^{128} times stronger with AES-256 than
> AES-128 also does not follow.
> 
Two points...  First, it may be a question of future-proofing: will
someone find a new cryptanalytic attack on AES-128 in the next, say, 20
years?  (You have, I assume, arranged for remote deletion of all of the
surreptitious copies of your DES-protected conversations from 20 years
ago, right?)

Second, 1024-bit RSA is a much weaker link than 128-bit AES *today* --
they should switch to 2048- or 3072-bit RSA even if they stick with
128-bit AES.


		--Steve Bellovin, http://www.cs.columbia.edu/~smb