Re: [saag] The use of AES-192 and AES-256 in Secure RTP

[Jon Callas <jon at callas.org>]

I agree with the assessment that there's no security need for  
AES-256. Until we get quantum computers or something like them, 128  
bits are enough. However, there are trends that make it so that  
AES-256 is now the norm, regardless of what we think. Here are a  
number of reasons:

* The intelligent-but-naive populace will think that 256 is better  
than 128. Bigger is better. The intelligent-but-paranoid crowd who  
vaguely remember the crypto wars are often convinced that 128-bits is  
now "exportable" (meaning easily breakable by efforts similar to  
DeepCrack). I talk to these people all the time. Yes, they exist.  In  
short, customers respond positively to the use of 256-bit keys.

* Suite B, which specifies 192/256 for top secret data reinforces the  
above. After all, if the government recommends 128 for secret data,  
and 256 for top secret, what's good for them is good for me.

* AES-256 is 20%-ish slower than AES-128. In real-world systems, this  
ends up being far less. I did a bit of googling as I composed this to  
look for charts and numbers. You can, too. But look at <http:// 
www.psc.edu/networking/projects/hpn-ssh/theory.php> which has nice  
charts of a variety of ciphers in SCP/SSH performance. In short, the  
*cost* of implementing AES-256 is low.

The effect of these together is that the costs of 256 bit keys are  
low, the benefits in marketing, perception, and merely being seen as  
up-to-date are high. You can also denigrate those who are not  
offering 256.

That's why you're seeing it. These aren't security reasons, they're  
human reasons.

	Jon