Re: [TLS] Comparative cipher suite strengths

[Martin Rex <[e-mail]>]

Nicolas Williams wrote:
> 
> On Thu, Apr 23, 2009 at 01:13:13PM -0400, Daniel Brown wrote:
> > Furthermore, adapting Eric's calculations below, to brute force
> > 112-bit keys, assuming 80-bit keys are brute forcible today (let's
> 
> 112-bit keys...  Ah, you must be thinking 3DES.  It's worth noting that
> one of the major cryptographic improvements in AES over 3DES is the
> block size.  The block size has a major impact on things like re-keying
> considerations.  So even assuming equal strength of 3DES and AES and
> that 112-bit keys are impossible to brute force now and forever, it'd
> still be worthwhile to switch from 3DES to to AES-128.

A few minor comments.

The bit-size is probably about "comparable symmetric cipher strength"
rather than actual key length.

A 3DES with 112-bit keys would be a two-key-triple-DES,
and it is IMHO from the 80-bit comparable symmetric strength ballpark.

In common use is 3-key-triple-DES (usually as 3DES-EDE-CBC),
which means a 168-bit key (when ignoring the parity bits)
and 112-bit comparable symmetric strength.

AES-128 is probably much faster in Software on common 32-bit
and 64-bit CPUs than 3DES (but I don't know about the modern CPUs
from the UltraSparc and Power architectures that have crypto support
built-in).

There is also a difference in the IV size (matching the cipher blocksize)
between 3DES and AES-128.

With 3DES you have additonal problems creating keys compared
to AES-128: none of the 3 subkeys of 3DES must have the same
value, and none of the subkeys should be one of the known
DES weak keys.


And as long as you don't reuse the same symmetric key all
the time, there probably is a difference in the "attributed
algorithm strength" based on the best-known attacks and the
effective protection strength of a moderately sized archived
piece of encrypted data.


In case the encryption key is based on a human-memorized
password (aka password-based encryption) rather than a strong
random session key (as in normal TLS ciphersuites),
then the effective strength of the protection might be *much*
smaller than what the chosen symmetric algorithm can
theoretically provide.

-Martin