Subject: [Cfrg] Self-correction on mismatched security ... RE: Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

From: Dan Brown <[email-masked]>
Date: Thu, 26 Feb 2015 21:55:34 +0000

> -----Original Message-----
> From: Dan Brown
>
> Though I voted above on 448 and 480 as acceptable, just to be clear, we
> should not label them as providing "256-bit security" and ___not use___ them with
> AES-256, until we solidify accounting arguments such compatibility, such as:

To correct and clarify myself on the ___underscored point above___ (thanks to an off-list reply):

There's no major problem per se using these smaller curves with AES-256.  (Isn't Suite B even more extreme in that regard?)  It's mainly that one ought not to overstate that the combination as providing 256-bit security.  For example, TLS cipher suite names with AES only mention the AES key size, which may be just fine for the sake of specification, but this number is potentially subject to misunderstanding as describing the overall security level.  So, a mismatch generally risks being confusing or misleading.  If you believe that 256-bit security is excessive, then you may also think that such confusion is all moot, and matching higher security levels is just more excessiveness.  If you believe that 256-bit security adds value, whatever that is, then surely you would not want to mislead anybody about it, at least not in a way that could be checked in a couple minutes.

There's a generic minor problem with mismatched strength primitives: the wasted extra computation (if any) of using the stronger than necessary primitive.  (I naively expect that AES-256 would be 14/12 times slower than AES-192.  I recall that SHA-512 is as fast as SHA-384, but do not recall much about other symmetric-key primitives.)  Just to avoid confusion, we could use (or re-label?) AES-224 with ECC-448 (i.e. if it's too much trouble to explain how ECC:AES is smaller than 2:1.)  Also, maybe Suite B is already a good match, though I haven't crunched the numbers.

---

From: Andy Lutomirski <[email-masked]>
Date: Thu, 26 Feb 2015 14:02:11 -0800

> There's no major problem per se using these smaller curves with AES-256.  (Isn't Suite B even more extreme in that regard?)  It's mainly that one ought not to overstate that the combination as prov…

If, on the other hand, you believe that 256-bit AES is a good idea
because it provides substantially better resistance against batch
attacks, then you would be quite happy with a WF ~ 2^128 curve and
AES-256.

I might go so far as to argue that *no* new protocols should use
symmetric ciphers with keys shorter than 256 bits for encryption.

--Andy