Subject: [TLS] Comparative cipher suite strengths

From: "Carl Young" <[email-masked]>
Date: Tue, 21 Apr 2009 16:32:54 +0100

Hi,

Can anyone point me to any documentation or information detailing the 
relevant strengths of cipher suites within TLS 1.x. I was wondering as the 
NIST publishes relevant key strengths - where a 1024 bit RSA key is assumed 
to provide an equivalence of 80 bits of security [SP800-57, part 1]; 3TDEA 
is 112 bits.

So, for TLS_RSA_WITH_3DES_EDE_CBC_SHA, assuming an RSA 1024 bit key-pair, 
would the effective strength of the connection be 80 bits or am I looking to 
compare apples and oranges?

If I want to negotiate AES-256, should I really be using a 15360 bit RSA key 
or, again, am I looking at this in the wrong way?

Thanks for any guidance. Regards,

Carl

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 21 Apr 2009 08:55:01 -0700

At Tue, 21 Apr 2009 16:32:54 +0100,
> or, again, am I looking at this in the wrong way?

Well, I think that this last bit is certainly looking at it the wrong
way. We don't know of any conditions under which AES-256 would be
breakable and AES-128 would not be, so talking about "key strength"
just doesn't make much sense at that level.

-Ekr