<story><title>Too Much Crypto [pdf]</title><url>https://eprint.iacr.org/2019/1492.pdf</url></story><parent_chain><item><author>vlovich123</author><text>The point this paper is trying to make is that we should be using safety margins based on knowledge rather than perpetuating the numerology that&amp;#x27;s been in-place to-date. The very same argument you&amp;#x27;re making here can be made regarding switching to 512-bit keys. And heck, why not 1024-bit keys too. The fundamental point the paper is making is:&lt;p&gt;A) The key size &amp;amp; number of rounds aren&amp;#x27;t where the security issues are today
B) We have a sufficient margin of error and understand the space well-enough that we&amp;#x27;re likely OK to use existing symmetric encryption with fewer rounds &amp;amp; smaller key lengths.
C) If you&amp;#x27;re a target of an attack the encryption keys are unlikely to present a significant challenge as attackers will choose easier alternate vectors.&lt;p&gt;I find the arguments pretty compelling especially when you consider A &amp;amp; C.</text></item><item><author>dwheeler</author><text>I read it, I don&amp;#x27;t buy it in general. In most use cases we need serious safety margins. Their &amp;quot;attacks always get better&amp;quot; section downplays serious issues.&lt;p&gt;First, it seems extreme hubris to think that something can&amp;#x27;t ever be broken before the human race disappears. There are plenty of algorithms that &lt;i&gt;have&lt;/i&gt; been broken over the years, and there is no mathematical proof that the current set are unbreakable. Sure, the algorithms they listed aren&amp;#x27;t broken yet, but that&amp;#x27;s a carefully crafted list. In any case, &amp;quot;not broken yet&amp;quot; is a far cry from &amp;quot;unbreakable&amp;quot;.&lt;p&gt;Another problem is that if a crypto algorithm is broken, there&amp;#x27;s a significant risk that the users of the algorithm will not be informed until possibly decades later. Many countries dedicate serious resources to attack, and would want to exploit those advantages if they could find them.&lt;p&gt;Finally, if a major algorithm (e.g., AES) was broken, it would take many years (probably more than 10) to replace it. The reality is that software systems are often hard to upgrade. Yes, that&amp;#x27;s a problem, but ignoring reality doesn&amp;#x27;t make it go away.&lt;p&gt;The only solution we know of is to have large margins.&lt;p&gt;In the physical engineering world, where we have far better understanding (due to physical models), smart engineers include significant margins when designing things. In the crypto area, where we do &lt;i&gt;not&lt;/i&gt; have good models showing that something cannot be broken &lt;i&gt;and&lt;/i&gt; the impact of failure is large, it is wise to have much bigger margins.&lt;p&gt;I agree that sometimes cryptographers incorrectly ignore other attacks. And no matter what, impractical attacks are - by definition - impractical. But I think it&amp;#x27;s wise to assume that attacks will get better, and we &lt;i&gt;cannot&lt;/i&gt; reasonably predict how much better they&amp;#x27;ll get over the years. Past performance is no guarantee of future results. Margins also increase the likelihood of a break being partial, giving people time to switch to another algorithm.&lt;p&gt;In special cases, maybe the margin doesn&amp;#x27;t need to be so big. But nobody likes dealing with special cases.</text></item></parent_chain><comment><author>brandmeyer</author><text>&amp;gt; The point this paper is trying to make is that we should be using safety margins based on knowledge rather than perpetuating the numerology that&amp;#x27;s been in-place to-date.&lt;p&gt;Exactly.  The point is that a fair A&amp;#x2F;B speed comparison between competing ciphers should be normalizing both A and B to equivalent security margins.  Instead, its been up to each individual cipher designer as to how many extra rounds should be used.&lt;p&gt;That said, I think the paper&amp;#x27;s point would be clearer if they had written down a complete table of &amp;quot;equivalent margin rounds&amp;quot; holding each of the standards constant.  Ie, how many rounds does ChaCha need to have equivalent margin to AES-128 at its specified number of rounds?</text></comment>
<story><title>Too Much Crypto [pdf]</title><url>https://eprint.iacr.org/2019/1492.pdf</url></story><parent_chain><item><author>vlovich123</author><text>The point this paper is trying to make is that we should be using safety margins based on knowledge rather than perpetuating the numerology that&amp;#x27;s been in-place to-date. The very same argument you&amp;#x27;re making here can be made regarding switching to 512-bit keys. And heck, why not 1024-bit keys too. The fundamental point the paper is making is:&lt;p&gt;A) The key size &amp;amp; number of rounds aren&amp;#x27;t where the security issues are today
B) We have a sufficient margin of error and understand the space well-enough that we&amp;#x27;re likely OK to use existing symmetric encryption with fewer rounds &amp;amp; smaller key lengths.
C) If you&amp;#x27;re a target of an attack the encryption keys are unlikely to present a significant challenge as attackers will choose easier alternate vectors.&lt;p&gt;I find the arguments pretty compelling especially when you consider A &amp;amp; C.</text></item><item><author>dwheeler</author><text>I read it, I don&amp;#x27;t buy it in general. In most use cases we need serious safety margins. Their &amp;quot;attacks always get better&amp;quot; section downplays serious issues.&lt;p&gt;First, it seems extreme hubris to think that something can&amp;#x27;t ever be broken before the human race disappears. There are plenty of algorithms that &lt;i&gt;have&lt;/i&gt; been broken over the years, and there is no mathematical proof that the current set are unbreakable. Sure, the algorithms they listed aren&amp;#x27;t broken yet, but that&amp;#x27;s a carefully crafted list. In any case, &amp;quot;not broken yet&amp;quot; is a far cry from &amp;quot;unbreakable&amp;quot;.&lt;p&gt;Another problem is that if a crypto algorithm is broken, there&amp;#x27;s a significant risk that the users of the algorithm will not be informed until possibly decades later. Many countries dedicate serious resources to attack, and would want to exploit those advantages if they could find them.&lt;p&gt;Finally, if a major algorithm (e.g., AES) was broken, it would take many years (probably more than 10) to replace it. The reality is that software systems are often hard to upgrade. Yes, that&amp;#x27;s a problem, but ignoring reality doesn&amp;#x27;t make it go away.&lt;p&gt;The only solution we know of is to have large margins.&lt;p&gt;In the physical engineering world, where we have far better understanding (due to physical models), smart engineers include significant margins when designing things. In the crypto area, where we do &lt;i&gt;not&lt;/i&gt; have good models showing that something cannot be broken &lt;i&gt;and&lt;/i&gt; the impact of failure is large, it is wise to have much bigger margins.&lt;p&gt;I agree that sometimes cryptographers incorrectly ignore other attacks. And no matter what, impractical attacks are - by definition - impractical. But I think it&amp;#x27;s wise to assume that attacks will get better, and we &lt;i&gt;cannot&lt;/i&gt; reasonably predict how much better they&amp;#x27;ll get over the years. Past performance is no guarantee of future results. Margins also increase the likelihood of a break being partial, giving people time to switch to another algorithm.&lt;p&gt;In special cases, maybe the margin doesn&amp;#x27;t need to be so big. But nobody likes dealing with special cases.</text></item></parent_chain><comment><author>mr__y</author><text>A) debatable&lt;p&gt;B) very,very debatable, especially this piece: &amp;quot;understand the space well-enough&amp;quot;&lt;p&gt;C) I tend to agree, but then (especially with hardware-supported crypto) there is not much to be gained by reducing the number of rounds</text></comment>