Re: [TLS] Proposed text for IDEA/DES document

["Steven M. Bellovin" <smb at cs.columbia.edu>]

On Wed, 06 Feb 2008 21:53:51 -0800
Mike <mike-list at pobox.com> wrote:

> >>> IDEA's problem is its patent, nothing more.
> > 
> > IDEA's problem also is the 64-bit block length.
> > 
> > With networks getting faster, it is increasingly easier to get
> > uncomfortably close to the number of blocks where you can no longer
> > expect full security (around 2^32 blocks, i.e. 32 GB, for CBC
> > encryption; with a non-neglible probability to have a security
> > failure well below this limit).
> 
> Can you explain how security weakens after sending 32GB of data?
> Is this just for IDEA or for AES and others as well?  In TLS,
> can you just renegotiate the security parameters well before
> reaching this threshold?
> 
The problem is the probability of a collision in the ciphertext
blocks.  The blocksize is 64 bits, for DES and IDEA; therefore, it's
collision resistance is O(sqrt(2^64)) or 2^32.  That's why AES has a
128-bit blocksize, to raise that parameter to 2^64 blocks.


		--Steve Bellovin, http://www.cs.columbia.edu/~smb
_______________________________________________
TLS mailing list
TLS at ietf.org
http://www.ietf.org/mailman/listinfo/tls