Subject: RE: AES-128 vs. 256, *again*

From: Mike Eisler <[email-masked]>
Date: Thu, 22 Jul 2004 20:03:54 -0700

> -----Original Message-----
 > From: Matt Crawford [mailto:[email-masked]]
 > Sent: Thursday, July 22, 2004 3:28 PM
 > To: Nicolas Williams
 > Cc: [email-masked]
 > Subject: Re: AES-128 vs. 256, *again*
 >
 >
 > > We've had this discussion before.  Solaris will have
 > AES-256 unbundled,
 > > and AES-128 instead.
 > >
 > > AES-128 is not even mentioned in
 > > draft-ietf-krb-wg-kerberos-clarifications-06.txt!
 > >
 > > I don't care if only AES-256 is required, but support for
 > AES-128 must
 > > be recommended for interop.
 >
 >
 > Invoking the Danvers Doctrine seems a bit harsh, but ...

I think Danvers only applies if Nico meant "RECOMMENDED"
and not "recommended". Assuming the former ...

AES-256 is better than AES-128 in terms of protection from brute
force attacks. Some references on the web claim AES-256
is slower than AES-128. So it may be the case
ther AES-128 is overall better. I don't know. Let's
assume the WG has decided that AES-256 is better.
If so, it is not harsh to not mention AES-128.
The Danvers Doctrine as stated in RFC3365 says:

"The overwhelming consensus [of the IETF32 plenary]
was that the IETF should standardize on the use of the best
security available, regardless of national policies."

Mentioning a feature as a MAY or SHOULD (RECOMMENDED) makes it part of
the standard. If such a security feature is not the best choice, then
it is in violation of Danvers.

Practically, AES-128 is likely going to be there, because
implementors and users generally want to interoperate.
I agree that if AES-128 were mentioned as a MAY or SHOULD
the likelyhood of presence and better interoperability
would increase. Nonetheless, it clashes with Danvers (IMHO of course).
Mentioning AES-128 as "recommended" will increase interoperability
though probably not as much as "RECOMMENDED".

Didn't the CAT WG go through this once with 40 bit DES for Kerberos V5?

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 23 Jul 2004 11:36:43 -0500

> and not "recommended". Assuming the former ...

I meant the latter.  "I don't care if only AES-256 is required, but ..."

Nico
--