3 ms·

If key size did not matter, we would not have variable key sizes for the same algorithm and mode. The most obvious case is brute forcing. Legacy systems are al

If key size did not matter, we would not have variable key sizes for the same algorithm and mode. The most obvious case is brute forcing. Legacy systems are all trivially defeated by small key sizes once weaknesses in the algorithm are found. And quantum computing cuts the key size in half, effectively; symmetric algorithms that can double their key size is the only practical defense [that I know of]. If you have to use RSA or DH - and many people have to - you have to increase the key size. But doubling key size with RSA results in up to a 7x performance decrease. Key size matters.

tptacek 10y ago
For good algorithms/constructions/primitives, like AES, even though there are selectable key sizes, they don't in practice matter (arguably they do in a post-quantum world, but they're the least of our concerns). There is no practical distinction between AES-128 and AES-256. There is a significant practical difference between RSA-1024 and RSA-2048. But you shouldn't use RSA at all. You should avoid it, as much as possible, for other reasons. I am militant about this point because key size selection is something everyone feels competent to nerd out about, but then they ship things like AES-256 running in unauthenticated CFB mode.
- peterwwillis 10y ago
  You are correct that AES's three key sizes are a result of the legacy of the military wanting "three levels of security" and NIST then asking for them. And since there is no requirement that they actually be more or less secure, they are practically equivalent - except for the known weakness in AES256, and the other in AES192, that don't present in AES128. In this sense, AES256 is somewhat shittier than AES128, even though there is no practical threat to anyone right now. But in practice, the future does matter, both due to legacy systems and possible unknown attacks. If an unknown attack can drop the key space, and then over time that becomes a practical brute force, you've lost the game. Unless you raise your key size. It's important to remember all the legacy cryptosystems that exist in embedded devices, all the support contracts that expire, and all the companies that go under and leave products that can only be tweaked and not upgraded. Lots of industries (healthcare, academia, government, embedded devices, 3rd party software, etc) rely on these products, and the more IoT is pushed the more crap is going to make its way into products that will never receive a firmware update. In some (many?) cases they will use shitty crypto, and the only defense that shitty crypto will have against the future is increasing the key size. So the problem with your statement is you said key sizes don't matter. In reality, they just matter the least, right now.
  - tptacek 10y ago
    In a soundly built modern system, AES-128 is going to be the last component that falls. -256 does not actually buy you any meaningful security margin in such a system. It simply doesn't matter. What matters is that you choose the right algorithms, the right modes, the right variants, the right authentication schemes, the right protocol designs. These are much harder problems, and the process of solving them will dictate your key sizes anyways.

tptacek 10y ago

For good algorithms/constructions/primitives, like AES, even though there are selectable key sizes, they don't in practice matter (arguably they do in a post-quantum world, but they're the least of our concerns). There is no practical distinction between AES-128 and AES-256. There is a significant practical difference between RSA-1024 and RSA-2048. But you shouldn't use RSA at all. You should avoid it, as much as possible, for other reasons. I am militant about this point because key size selection is something everyone feels competent to nerd out about, but then they ship things like AES-256 running in unauthenticated CFB mode.

peterwwillis 10y ago
You are correct that AES's three key sizes are a result of the legacy of the military wanting "three levels of security" and NIST then asking for them. And since there is no requirement that they actually be more or less secure, they are practically equivalent - except for the known weakness in AES256, and the other in AES192, that don't present in AES128. In this sense, AES256 is somewhat shittier than AES128, even though there is no practical threat to anyone right now. But in practice, the future does matter, both due to legacy systems and possible unknown attacks. If an unknown attack can drop the key space, and then over time that becomes a practical brute force, you've lost the game. Unless you raise your key size. It's important to remember all the legacy cryptosystems that exist in embedded devices, all the support contracts that expire, and all the companies that go under and leave products that can only be tweaked and not upgraded. Lots of industries (healthcare, academia, government, embedded devices, 3rd party software, etc) rely on these products, and the more IoT is pushed the more crap is going to make its way into products that will never receive a firmware update. In some (many?) cases they will use shitty crypto, and the only defense that shitty crypto will have against the future is increasing the key size. So the problem with your statement is you said key sizes don't matter. In reality, they just matter the least, right now.
- tptacek 10y ago
  In a soundly built modern system, AES-128 is going to be the last component that falls. -256 does not actually buy you any meaningful security margin in such a system. It simply doesn't matter. What matters is that you choose the right algorithms, the right modes, the right variants, the right authentication schemes, the right protocol designs. These are much harder problems, and the process of solving them will dictate your key sizes anyways.