Subject: [AVT] The use of AES-192 and AES-256 in Secure RTP

From: David McGrew <[email-masked]>
Date: Thu, 4 May 2006 12:15:10 -0700

Hello,

here's some additional text that explains the "hedge" strategy.   
Perhaps it's worth adding to the draft.  Comments welcome.

David

The main motivation for AES-192 and AES-256 is to provide alternative  
ciphers to AES-128 that can be adopted in event that unforeseen  
advances in cryptanalysis significantly erode the security level of  
AES-128.  The main purpose of this specification is to provide  
algorithm agility to SRTP, to allow that protocol to easily adopt the  
alternative ciphers if the need arises in the future.  It MUST NOT be  
interpreted as discouraging the use of AES-128.  Implementers MAY  
support the alternative ciphers in advance of any need to replace  
AES-128, in order to facilitate a potential future 'hot swap'  
replacement, but those implementations MUST be prepared to  
interoperate with implementations that do not support the alternative  
ciphers.

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 4 May 2006 12:26:17 -0700

At 12:15 PM -0700 5/4/06, David McGrew wrote:
>It MUST NOT be
>interpreted as discouraging the use of AES-128.

Half-nit: that's an improper use of MUST NOT according to RFC 2119.

More important: you also don't want to encourage use of things other 
than AES-128 unless needed.

Proposed change: It should not be interpreted as discouraging the use 
of AES-128, nor encouraging the use of AES-192 or AES-256 unless 
there is a strong cryptographic reason to do so.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 8 May 2006 09:12:03 -0700

At 12:15 PM -0700 5/4/06, David McGrew wrote:
>AES-128.

The downside of proposing multiple alternative ciphers, as compared 
to just one, is that it is likely that implementers will not do 
interop testing on all of them. It is much better to propose just one 
fall-back cipher. This is particularly true for AES, as we have 
discovered in the VPNC test lab.

For IETF standards where AES-128 is a MUST-level requirement, there 
should be just one fall-back, AES-256, with wording like the 
"SHOULD+" definitions in RFC 4307.

--Paul Hoffman, Director
--VPN Consortium

---

From: David McGrew <[email-masked]>
Date: Mon, 8 May 2006 09:17:54 -0700

Paul,

good points, I'm convinced that it would be better to dump AES-192  
from the spec.

David

On May 8, 2006, at 9:12 AM, Paul Hoffman wrote:

>> The main motivation for AES-192 and AES-256 is to provide  
>> alternative ciphers to AES-128 that can be adopted in event that  
>> unforeseen advances in cryptanalysis significantly erode the  
>> security level of
>> AES-128.
>
> interop testing on all of them. It is much better to propose just  
> one fall-back cipher. This is particularly true for AES, as we have  
> should be just one fall-back, AES-256, with wording like the "SHOULD 
> +" definitions in RFC 4307.
>
> --Paul Hoffman, Director
> --VPN Consortium