Subject: Re: PKINIT-23: DH GROUP SELECTION: ticket 530

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 19:47:27 -0500

On Wednesday, January 26, 2005 06:08:47 PM -0500 Sam Hartman 
<[email-masked]> wrote:

> I'd recommend looking at mandating support for AES128 in pkinit
> implementations and suggesting that be used instead of aes256 so you
> can get a smaller DH group.

This is now ticket #834.

One suggestion does not a consensus make.
Does anyone want to comment on this?

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 8 Feb 2005 00:12:46 -0600

> Does anyone want to comment on this?

Can PKINIT mandate AES-128 when clarifications doesn't?  If not the
answer should be that PKINIT should require support for a group
sufficiently large to key AES-256.