Subject: [ietf-tls] AES key lengths

From: Pete Chown <[email-masked]>
Date: Fri, 1 Dec 2000 15:37:58 +0000

Okay, on the subject of AES key lengths it seems as though there are
several people wanting it and a couple of people opposed (including
me).

In the circumstances it seems fairest to add the new ciphersuites,
because no one is actually forced to implement them.  I propose that
the new ciphersuites be "MAY".  The interoperability requirements will
be kept the same and will refer to the 128-bit ciphersuites.

The number of ciphersuites will therefore increase by a factor of
three, with a 192-bit and a 256-bit variant of each current
ciphersuite being added.

If anyone has serious objections to this way of proceeding, please let
me know.

I will also fix the problem where the AES block size is not specified.

Another point is that many people on this list have been very helpful
with suggestions and analysis.  If anyone would like their
contribution acknowledged more specifically in the document please let
me know.

As I said before, please could everyone think carefully whether there
are any more outstanding issues.  I get the feeling we are almost
there; if all the issues can be raised now then the upcoming draft can
be the last one.

-- 
Pete

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Eric Rescorla <[email-masked]>
Date: 01 Dec 2000 08:09:54 -0800

> If anyone has serious objections to this way of proceeding, please let
I really don't think this is necessary. Let's for the moment say that
the arguments for why we need 256 are convincing. (I don't think so,
but never mind that). I don't see why this means we need all three
lengths.

At most this motivates for 128 and 256. 

Sure, it's possible that 192 is more secure than 128 or 256, but
if we believe that it suggests that AES is seriously broken and 
we need a different backup entirely.

-Ekr

---

---

From: [email-masked] (Nelson Bolyard)
Date: Fri, 01 Dec 2000 13:42:07 -0800

> there; if all the issues can be raised now then the upcoming draft can

In a few months, the official Federal Information Processing Standard
for AES will come out, and I expect it will have something to say about
requirements for use of specific key sizes.  Some of our larger customers
will then need a TLS that conforms to those requirements.  

If the TLS/AES spec limits the choice of key size to a value other than 
what the FIPS ultimately requires, it will almost certainly need to be
revised.  I think this argues for either (a) allowing a number of choices
now, or (b) waiting for the FIPS before finalizing the TLS/AES spec.

--
Nelson Bolyard               Sun / Netscape Alliance
Disclaimer:                  I speak for myself, not for Netscape

---

---

From: Ben Laurie <[email-masked]>
Date: Sat, 02 Dec 2000 12:07:23 +0000

> there; if all the issues can be raised now then the upcoming draft can

Its been raised already, but I don't remember seeing a resolution ...
what about block length?

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

---

From: "Andreas Sterbenz" <[email-masked]>
Date: Mon, 4 Dec 2000 11:11:03 +0100

Let's not forget that Rijndael is defined for any combinations of block size
and key length of 128, 160, 192, 224, and 256 bit. that makes 25 variations
times 6 ciphersuites for the various key exchanges, that is 150 ciphersuites
we need to define. Just kidding of course.

Regarding block sizes, NIST has not asked and nobody ever really looked at
block sizes other than 128 bit. I would be very surprised if they were to
become part of the FIPS and there seems no interest in them from other
sources either. I think we are very safe if we keep to 128 bit only.

Regards,

 Andreas Sterbenz              mailto:[email-masked]

----- Original Message -----
From: "Ben Laurie" <[email-masked]>
To: "IETF Transport Layer Security WG" <[email-masked]>
Sent: Saturday, December 02, 2000 1:07 PM
Subject: [ietf-tls] Re: AES key lengths

---