Subject: [Openpgp-dt] MTI for symmetric ciphers: AES-128, AES-256, or both?

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 02 Nov 2021 01:05:18 -0400

Hi DT--

Over on https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/48,
Paul is suggesting that we reconsider the MUST implement for AES 128.

I don't want to put words in his mouth, but i think he's asking for one
of two different choices for our mandatory-to-implement symmetric
ciphers:

1) a change from MUST AES-128 to MUST AES-256
2) a change from MUST AES-128 to MUST AES-128 and AES-256

Or we could go with the status quo in that outstanding MR:

0) keep as MUST AES-128

Paul's argument for 1 or 2 is:

> It seems most other protocols have said support for AES-256 is a MUST,
> partially based on Shor's algorithm halfing the key space. eg RFC 8221
> states:
> 
> IPsec sessions may have very long lifetime and carry multiple packets,
> so there is a need to move to 256-bit keys in the long term. For that
> purpose, the requirement level for 128-bit keys and 256-bit keys is
> MUST (when applicable). In that sense, the status for 256-bit keys has
> been raised from MAY in [RFC7321] to MUST.
> 
> RFC 8247 states:
> 
> ENCR_AES_CBC is raised from SHOULD+ for 128-bit keys and MAY for
> 256-bit keys in [RFC4307] to MUST. 192-bit keys remain at the MAY
> level.
> 
> I think as openpgp also deals with very long term data, that 256bit
> key sizes should be a MUST and not a SHOULD

Do DT members have a preference here?

   --dkg

---

From: NIIBE Yutaka <[email-masked]>
Date: Fri, 05 Nov 2021 12:09:47 +0900

Hello,

> Do DT members have a preference here?

My (weak) preference is:

    0) keep as MUST AES-128

I don't have strong objection to include (or replace with) AES-256, as
most implementations of AES has AES-256 as well as AES-128.

And if it's a discussion for key size, it's totally OK for me.  Like
having Ed448/X448 for public key algo in OpenPGP as well.

On the other hand, my concern is that a rationale for any change is
better to be coherent.

IIUC, a discussion may be a topic of quantum computing.  And for AES, I
think that it's Grover's algorithm[1], which matters.  And in such a
hypothetical case, Shor's algorithm could be used to break public key
encryption (of OpenPGP).

If quantum computing is major reason, we would need to consider public
key algo with quantum resistance.

[1] https://en.wikipedia.org/wiki/Grover%27s_algorithm
--