Subject: Re: [Cfrg] Providing guidance on the choice of symmetric key length?

From: "The Purple Streak, Hilarie Orman" <[email-masked]>
Date: Mon, 3 May 2004 18:33:00 -0600

Unless there is a fundamental change in the basis of computing (such as
quantum computing), a key size of 128 bits (that's 128 bits of entropy)
should last forever, based on a rough estimate of energy consumption.
Very few applications on the Internet today need that level of security.
112 bits is still good enough for all practical purposes.

You'd have to be really paranoid to protect against quantum computing ---
it's hardly even a glimmer on the horizon.  If you are worried, because
you've got data that MUST remain confidential for more than a human
lifetime, then use a 256-bit key.

I've seen many vendors boast that they use 256-bit keys for "maximum"
security.  Very impressive.  Now, what is the probability that they've
got some design flaw that renders all that security worthless?

Hilarie

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 03 May 2004 23:03:55 -0400

In message <[email-masked]>, "The Purple Str
>lifetime, then use a 256-bit key.

Right.  The best known quantum algorithms for attacking symmetric 
ciphers have complexity the square root of the key size.  For a 128-bit 
cipher to fall to such a thing, you'd not only need a quantum computer, 
you'd need a massively parallel one that could do 2^64 operations.  I'm 
not holding my breath waiting for that.

>got some design flaw that renders all that security worthless?

Yup.

		--Steve Bellovin, http://www.research.att.com/~smb