Subject: Re: AES-256 vs AES-128 (Re: Suggested DER Prefixes)

From: Jon Callas <[email-masked]>
Date: Sun, 01 Jun 2003 03:27:24 -0700

On 5/30/03 4:48 PM, "John Wilkinson" <[email-masked]> wrote:

> 
> With all due respect, Jon, I would like to see a quote from a recognized
> crypto expert who feels that AES-128 is "safer" than AES-256.

I think you misunderstand what I'm saying.

In crypto circles, there's a subtle difference between being conservative
and being insecure. Safety is like wine. It ages over years. We tend to use
the word "safe" informally.

What I said was that the 256 bit ciphers make two changes, and that makes
them daring. I did say that I did not share the concerns I've heard, but I
still value them as the opinions of colleagues.

As for "recognized crypto experts" -- well, there are a lot of them here,
even if a number of us crypto experts aren't cipher designers. You've heard
from recognized crypto experts, and note that there's a variation of
opinion, and some of them say that yes, AES-256 is more daring than AES-128.

When I was at Counterpane, we used Blowfish over either AES or Twofish,
despite the fact that we thought that AES and Twofish both were better
designs. It was all a matter of aging, and it was at that time that
Schneier, Ferguson, and Kelsey (all Twofish designers) opined precisely what
I said -- that all of the AES candidates should be used in 128-bit mode, as
that was better understood.

Now Ferguson and Schneier have a new book out, "Practical Cryptography" and
their opinions are well worth paying close attention to, even if you don't
completely agree. 

Personally, I stick with 128-bit keys, but that's because I think too many
people want more bits in their keys without understanding what's going on.

The question, "Will a key with more bits give me better security?" is a lot
like the question, "Will more cylinders in my car engine make me go faster?"
The answer to both is, "Ummm, well, maybe. Usually yes, but too many can
actually cause all sorts of troubles." It's not what people want to hear.

    Jon

---

From: Adam Back <[email-masked]>
Date: Mon, 2 Jun 2003 01:31:33 +0100

Not sure if this is what you were referring to about their comments in
Practical Cryptography, but in that book they argue for use of 256-bit
keys on the basis that protocols and algorithms more frequently than
we'd like fall victim to variants of the meet-in-the-middle attack
where the key space ends up being half as many bits as you thought it
might.

So personally I'm not sure I buy that particular argument, but I
happen to share the conclusion: 256-bit keys are a good idea.

Also I'd think the most suspect aspect of a 256-bit keyed cipher is
whether it truly achieves 256-bits of strength.  I'd say it's much
less controversial however to say 256-bit AES provides a better margin
of security than 128-bit AES.

Adam

---

From: Mike Markowitz <[email-masked]>
Date: Tue, 24 Jun 2003 15:54:49 -0500

At 03:10 PM 5/31/2003 +0200, Bodo Moeller wrote:

>Of course arguably 128 bits are by far enough so that you don't really
>have to worry about anything of this -- unless you think that quantum
>attacks might become realistic.

Just when you thought this thread was dead... <g>

Here NSA's current view of the matter (from the recent "CNSS Policy No. 15, 
FS-1"
document: http://csrc.nist.gov/cryptval/CNSS15FS.pdf):

"(6) The design and strength of all key lengths of the AES algorithm (i.e., 
128, 192
and 256) are sufficient to protect classified information up to the SECRET 
level.
TOP SECRET information will require use of either the 192 or 256 key lengths."

-mjm