Subject: RE: AES and SHA-1 timing

From: "Paul Leach" <[email-masked]>
Date: Mon, 14 Apr 2003 18:58:25 -0700

> 
> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]] 
> Sent: Monday, April 14, 2003 11:58 AM
> To: Paul Leach
> Cc: Ken Raeburn; [email-masked]
> 
> >>>>> "Paul" == Paul Leach <[email-masked]> writes:
> 
>     Paul> Even though 256 bits is mandatory to implement, 128 bits is
>     Paul> quite adequate to deploy in practice. Doesn't that mean that
>     Paul> all these numbers should be halved?
> 
> No, because you cannot guarantee that the client will support 
> the enctype.

Huh? It's the client that is generating the key from the password to use
to encrypt the preauth for the AS-REQ -- isn't that the context we're
talking about here? Can't it know what enctypes it supports?

---

From: "Paul Leach" <[email-masked]>
Date: Wed, 16 Apr 2003 10:41:58 -0700

> From: Marcus Watts [mailto:[email-masked]] 
> Sent: Wednesday, April 16, 2003 12:28 AM
> To: [email-masked]
> Subject: Re: AES and SHA-1 timing 

> Probably by the time we are actually able to 
> turn DES off (at best >4 years?), the timing model that Paul 
> Leach used to justify his 1 second delay will be completely 
> obselete, if it isn't already out of date.

The iteration count will have to periodically be tweaked upward to
account for increasing machine speed.

> We see some form 
> of preauthentication logic as being a much more promising way 
> to protect weak keys.

I don't fully understand this comment, but the timing model I gave
assumed passwords that are about as strong as humans can remember.

Paul