> but we use 64 bit keys [...] to do authentication, and that's known to be totally safe. I disagree with that. Using 64-bit authentication tags is fine, since

> but we use 64 bit keys [...] to do authentication, and that's known to be totally safe. I disagree with that. Using 64-bit authentication tags is fine, since they can only be attacked by sending guesses to the target system. 64-bit however are too weak, since they can be attacked using same offline brute-force attacks used against confidentiality. They have the advantage that an attacker needs to break them before they're changed/the project ends, while confidentiality can be important for many decades after that. But even then, I'd say 96 bits is the minimum authentication key size for a high value system, while I'd go with 128 bits.