Subject: PKINIT-24 #834: PKINIT AES128?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 18 Feb 2005 09:23:51 -0800

This issue should have been closed by -24.

One does not need to artificially reduce the AES cipher strength to
match the strength of a given DH modulus size. The key word here is
"sufficient" strength, or "matching" strength. 

Here is the -24 text for this:

   6.  The client's Diffie-Hellman public value (clientPublicValue) is
       included if and only if the client wishes to use the
       Diffie-Hellman key agreement method.  For the Diffie-Hellman key
       agreement method, implementations MUST support Oakley 1024-bit
       MODP well-known group 2 [RFC2412] and SHOULD support Oakley
       2048-bit MODP well-known group 14 and Oakley 4096-bit MODP
       well-known group 16 [RFC3526].

       The Diffie-Hellman field size should be chosen so as to provide
       sufficient cryptographic security.  The following table, based on
       [LENSTRA], gives approximate comparable key sizes for symmetric-
       and asymmetric-key cryptosystems based on the best-known
       algorithms for attacking them.

                  Symmetric    |  ECC    |  DH/DSA/RSA
                  -------------+---------+------------
                     80        |  163    |  1024
                    112        |  233    |  2048
                    128        |  283    |  3072
                    192        |  409    |  7680
                    256        |  571    |  15360

                 Table 1: Comparable key sizes (in bits)

       When Diffie-Hellma modulo a prime p is used, the exponents should
       have at least twice as many bits as the symmetric keys that will
       be derived from them [ODL99].

Any comments?