Subject: RE: [Cfrg] Providing guidance on the choice of symmetric key leng th?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 6 May 2004 07:00:55 -0700

> You'd have to be really paranoid to protect against quantum 
> computing ---
> it's hardly even a glimmer on the horizon.  If you are 
> worried, because
> you've got data that MUST remain confidential for more than a human
> lifetime, then use a 256-bit key.

It is pretty easy to give a minimum in this area. But there is no real
limit on the maximum bit length. 

RSA is kinda useful in that regard, when the keys get beyond 512 bits 
you start to see some pain as you try to implement. 2048 bit keys start
to become really inconvenient when you are trying to pack data into
UDP packets.

The number of bits in the key length is probably less important than 
the number of rounds. I do not expect AES to be broken by brute force
at any key strength. If it is broken it will be because the number
of rounds is not sufficient. At one of the RSA conferences Adi Shamir 
said he would prefer it if the number of rounds was increased to
provide a safety margin. Using a longer key also buys some extra rounds.

		Phill

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: Uri Blumenthal <[email-masked]>
Date: Thu, 06 May 2004 14:05:22 -0400

> provide a safety margin. Using a longer key also buys some extra rounds.

I'm glad somebody else said this!  Phillip, I'm with you on this one.