Subject: Re: [TLS] Comparative cipher suite strengths

From: Martin Rex <[email-masked]>
Date: Mon, 4 May 2009 16:49:43 +0200 (MEST)

Eric Rescorla wrote:
> 
> At Thu, 30 Apr 2009 18:56:35 -0700,
> Bill Frantz wrote:
> > 
> > [email-masked] (Nicolas Williams) on Thursday, April 23, 2009 wrote:
> > 
> > >The more likely explanation is that *some* imaginable
> > >cryptanalytic advances could reduce the effective strength of AES in
> > >such a way that longer keys remain more secure than shorter keys.
> > 
> > When I think of the reasons that NSA/DOD could have for requiring AES-128
> > for secret and AES-192 for top secret, I think they may be looking at the
> > whole cryptographic system. While symmetric cyphers have some solid math
> > behind them, other parts of the system, such as generating random numbers
> > for the keys are frequently more akin to black magic.
> > 
> > If my random numbers were only 75% random against some attack, with AES-192
> > I would still have 128 bits of strength against a brute force attack. With
> > AES-128, I'd only have 96 bits, and I would be quite concerned when
> > protecting top secret data.
> 
> I don't think this lines up particularly well with how CSPRNGs
> work. You start with some random seed information S which you
> use to seed the CSPRNG. That seed has some number of bits of
> entropy. Call it E. You then generate your cryptographic key.
> No matter how long that key is, the total strength of the system
> is the cost of brute-forcing S, i.e., 2^E operations. This is true
> whether the symmetric cipher is 128 bits or 256 bits.

It is not universally true that the "seed" of a CSPRNG is smaller
than its random output. 

There are implementations of CSPRNGs (cryptographic strength pseudo
random number generators) that use a large internal state (or
"entropy pool", much larger than the randoms that are returned
on each invocation.  It is usually possible to "seed" that pool
with large entropy (i.e. > 128 bit) as well.

Gathering sufficient seed entropy is usually not a problem (100 bits/second
is simple), but compressing that entropy into a fixed size "entropy pool" /
CSPRNG internal state ist probably something that cryptographers should
look at.

-Martin

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 04 May 2009 08:25:26 -0700

At Mon, 4 May 2009 16:49:43 +0200 (MEST),
> It is not universally true that the "seed" of a CSPRNG is smaller

Yes, that's true, but in that case Bill's analysis isn't
relevant.

-Ekr