Subject: Two AES ciphers

From: Paul Hoffman / IMC <[email-masked]>
Date: Sat, 08 Apr 2000 19:34:22 -0700

For the past few months, there has been much talk of the likelihood that 
the AES process will come out with two ciphers, not one. This was talked 
about at the SAAG meeting in Adelaide, and folks from NIST said that this 
was indeed the current thinking.

RFC 2440 and the current 2440bis draft has algorithm IDs that say "Reserved 
for AES with 128-bit key" and so on. It might be wise to allocate another 
three and specify that the actual algorithms used for IDs 7, 8, and 9 (and 
probably 11, 12, and 13) will be defined by a future RFC.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Jon Callas <[email-masked]>
Date: Sun, 9 Apr 2000 14:49:10 -0700

>probably 11, 12, and 13) will be defined by a future RFC.

I'd prefer to wait, myself. There are a few reasons for it.

I'm of two minds about this. Last spring I came out against it in my
comments to NIST. There's been talk about it since the first AES
conference, but it's only been talk. In the past, the main rationale for
more than one AES was that the AES has many goals, and it wasn't clear that
one cipher could serve all of those goals.

However, the analysis shows that at least three of the five finalists are
usable in all contexts, from smart cards to high-performance systems.If the
main argument for more than one AES is concern about usability on smart
cards (or other limited system -- the 8051 is probably going to be with us
always) and big switches, that concern has been addressed.

To my mind, the other technical rationale is the "what if it breaks"
question. That's a completely different can of worms, though. I think this
is the only reasonable reason for more than one algorithm, but it raises a
number of algorithms. If you have one, there's no good backup plan. If you
have more than one, the odds that you'll have to deal with *some* broken
cipher is higher. Ironically, under this argument, I tend to side with
notion of redundancy, but I respect the opinions of people who want
simplicity, and see their point.

(There's a third reason, and that's political. Let's suppose that the
technical favorite in NIST were Rijndael. Beyond the amusement value of
having a US standard cipher being written by people outside the US, that's
pretty much the icing on the cake for the argument that US governmental
controls on crypto have merely helped export crypto knowledge. It would
therefore behoove them to pick a second AES that they could slap a "Made in
USA" sicker on. But I digress.)

The third AES conference is next week. I hope this gets addressed there. If
they say there that yes, definitely, there will be two algorithms, then so
be it.

Until NIST says something official, the issue of whether there should be
more than one AES is under debate. As you can see, I have mix emotions
about the issue. I think it would be high-handed for me to act as if I know
what NIST is going to do before they've done it. It short-circuits the
debate.

If NIST says there's going to be two AES ciphers, it's five minutes of work
to add it in. I'm not sending out a revision next week, or the week after.
In three to four weeks there may be another 2440bis, if we get the MDC
hammered out. If a week after that I have to put out another draft, sure.
There's just no reason to do it now. It's not like we might run out of
algorithm numbers.

	Jon

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 10 Apr 2000 10:26:05 -0700

At 02:49 PM 4/9/00 -0700, Jon Callas wrote:
>I'd prefer to wait, myself.

As long as you are willing to simultaneously hold up progression of 
2440bis, that's good thinking. However, I didn't want to assume that timing.

>There's just no reason to do it now. It's not like we might run out of

The problem is that NIST probably won't decide until September (or whenever 
they actually announce the winner/winners). They have explicitly said that 
they are going to take the one/two discussion that happens at the upcoming 
meeting as input for their decision. It would be nice if they say soon 
whether there will be one or two, but the last I heard they won't decide 
about one/two before they announce the winner/winners. If we don't get a 
firm commitment on one/two soon, then the OpenPGP WG needs to think about 
what we want to do about progressing 2440bis before the AES announcement.

--Paul Hoffman, Director