Subject: Re: Camellia for OpenPGP

From: Hironobu SUZUKI <[email-masked]>
Date: Tue, 01 May 2007 12:49:43 +0900

David,
 
> I notice you're just mentioning Camellia with a 256-bit key, which
> leaves out the 128 or 192-bit keys.  I don't disagree, but I'm
> curious if that was intentional.

Yes, intentional. I chose Camellia-256 by the point of view of
marketing.

I found that may people had selected TLS/AES-256 ciphersuite for their
https when they could use it under their system. Many people think
"more strong cipher for me".  I know that it is overkill for thier
security.  But most important thing is "to supply what users want to
get".

And there are many 128-bit ciphers which are already used. People will
use a cipher that they used to using.  But in 256-bit ciphers, there
only two ciphers except Camellia and many people aren't familiar with
256-bit cipher yet. In that situation, it will be easy to accept
Camellia-256bit.

Camellia-256 is good for surviving cipher war.

Regards,

---
Hironobu SUZUKI <hironobu at h2np dot net><hironobu at fsij dot org>
Hironobu SUZUKI Office, Inc. / FSIJ / WCLSCAN / OpenPKSD
Tokyo, Japan.
http://h2np.net

---

From: Rodney Thayer <[email-masked]>
Date: Mon, 30 Apr 2007 22:27:22 -0700

Hironobu SUZUKI wrote:
> https when they could use it under their system.

AES-256 is listed in a NIST recommendation.  It's not marketing,
it's following NIST guidance.

Not to say that's not debatable but it's not just "marketing" or
key material size obsession.

---

From: Hironobu SUZUKI <[email-masked]>
Date: Tue, 01 May 2007 15:37:36 +0900

Rodney, 
 
> it's following NIST guidance.

I'm taking about TLS/AES-256, not taking about AES-256. In TLS WG,
they tried to adapt only AES-128 and ignored AES-256. First of all,
they said "AES-256 is too much". I pushed AES-256 to TLS because it
was nice for backup cipher for AES-128 and it was only a chance to
adapt 256-bit cipher to TLS.

They didn't select AES-256 as by NIST recommendation. They didn't
select AES-192 also. They selected AES-256 as "backup for 128bit
cipher".

That is ture story.

At that time, I didn't think that many people use AES-256 because
actually, AES-128 was enough.

Today, in fact, many people use AES-256.  I learn that people tend to
use stronger cipher which is prepared for them because they want to
feel safer. That is a sort of psycological attitude, not technical
attitude.

> Not to say that's not debatable but it's not just "marketing" or key
> material size obsession.

I'm sorry that I confused you by my English capability.  

I meant a term "marketing" that I said is as "to know what people want
to get".  I have thought that we should provide a service for people
by what people want to do, not by engineer's ego.  And I have thought
that we should think something practical.  To implement Camellia-256
is practical thing more than to implement a set of Camellia-128/256. A
set of Camellia-128/256 may be acceptable but a few people will use
Camellia-128 because there are other 128-bit ciphers and it's too late
to list it up.  So, I list only Camellia-256 and I think it is OK for
everyone.

Also, only Camellia-256 is nothing special because only TWOFISH-256 is
listed in OpenPGP cipher.

Regards,

---