> But I think that your main point is that we don't need to implement > AES-256 in order for it to have value as a hedge. This is valid. Yes, as far as it goes - but (and here I speak as someone who's written a Rijndael implementation) having done AES-128, the incremental cost of doing AES-256 as well is minimal. The two can share almost all of their code. Unless, I suppose, you're doing it in silicon and hardwire in the shift and rounds values, or some such. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse at rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.