Problem - Kevin Tafuro

locations where 40-bit keys or 56-bit keys are used, because weak encryption used to
be the maximum level of encryption that could be exported from the United States.
Symmetric key length recommendations do not apply to public key
lengths. See Recipe 7.3 for public key length recommendations.
Supporting cryptographically weak configurations is a risky proposition. Not only
are the people who are legitimately using those configurations at risk, but unless you
are extremely careful in your protocol design, it is also possible that an attacker can
force the negotiation of an insecure configuration by acting as a “man in the middle”
during the initial phases of a connection, before full-fledged encryption begins. Such
an attack is often known as a rollback attack, because the attacker forces the communicating
parties to use a known insecure version of the protocol. (We discuss how to
thwart such attacks in Recipe 10.7.)
In the real world, people try very hard to get to 80 bits of effective security, which we
feel is the minimum effective strength you should accept. Generally, 128 bits of effective
security is considered probably enough for all time, if the best attack that can be
launched against a system is brute force. However, even if using the right encryption
mode, that still assumes no cryptographic weaknesses in the cipher whatsoever.
In addition, depending on the way you use encryption, there are precomputation and
collision attacks that allow the attacker to do better than brute force. The general
rule of thumb is that the effective strength of a block cipher is actually half the key
size, assuming the cipher has no known attacks that are better than brute force.
However, if you use random data properly, you generally get a bit of security back
for each bit of the data (assuming it’s truly random; see Recipe 11.1 for more discussion
about this). The trick is using such data properly. In CBC mode, generally the
initialization vector for each message sent should be random, and it will thwart these
attacks. In most other modes, the initialization vector acts more like a nonce, where
it must be different for each message but doesn’t have to be completely random. In
such cases, you can select a random value at key setup time, then construct per-message
initializers by combining the random value and a message counter.
In any event, with a 128-bit key, we strongly recommend that you build a system
without a 64-bit random value being used in some fashion to prevent against attack.
Should you use key lengths greater than 128 bits, especially considering that so many
algorithms provide for them? For example, AES allows for 128-bit, 192-bit, and 256bit
keys. Longer key lengths provide more security, yet for AES they are less efficient
(in most other variable key length ciphers, setup gets more expensive, but encryption
does not). In several of our own benchmarks, 128-bit AES is generally only
about 33% faster than 256-bit AES. Also, 256-bit AES runs at least 50% faster than
Selecting an Appropriate Key Length | 161
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.