Subject: [eap] Re: Issue 79: Proposed text (Key strength estimate)

From: [email-masked] (Bernard Aboba)
Date: Wed, 12 Feb 2003 09:25:52 -0800 (PST)

This looks good to me. What do other people think?

Message: 9
Date: Wed, 12 Feb 2003 17:54:18 +0200
From: <[email-masked]>
To: <[email-masked]>
Subject: [eap] Proposed text for Issue 79 (Key strength estimate)

Here's my shot at Issue 79:

  [d] Key strength. If the method derives keys, then the effective key
  strength MUST be estimated. This estimate is meant for potential users
  of the method to determine if the keys produced are strong enough for
  the intended application.

  The effective key strength SHOULD be stated as number of bits, defined
  as follows: If the effective key strength is N bits, the best
  currently known methods to recover the key (with non-negligible
  probability) require an effort comparable to 2^N operations of
  a typical block cipher. The statement SHOULD be accompanied by a
  short rationale, explaining how this number was arrived at.

  (Note: Although it is difficult to define what "comparable effort" and
  "typical block cipher" exactly mean, reasonable approximations are
  sufficient here. Refer to e.g. [SILVERMAN] for more discussion.)

  The key strength depends on the methods used to derive the keys.
  For instance, if keys are derived from a shared secret (such as a
  password or master key), and possibly some public information
  such as nonces, the effective key strength is limited by the
  entropy of the long-term secret (assuming that the derivation
  procedure is computationally simple). To take another example, when
  using public key algorithms, the strength of the symmetric key
  depends on the strength of the public keys used.

And add this to "Informative References":

  [SILVERMAN]
  Robert D. Silverman: A Cost-Based Security Analysis of Symmetric and
  Asymmetric Key Lengths. RSA Laboratories Bulletin 13, April 2000
  (Revised November 2001).
  http://www.rsasecurity.com/rsalabs/bulletins/bulletin13.html

(I know that there are other papers about the same subject as
Silverman's, some of which present somewhat different estimates
about how strong various key lengths are, but for this purpose,
a rough estimate is probably good enough)

Best regards,
Pasi

---

From: [email-masked] (Joe Salowey)
Date: Wed, 12 Feb 2003 11:47:19 -0800

Looks good.  I think we need to expand upon the fact that for many
mechanisms the entropy of generated keys is variable (based on the
underlying secrets, passwords and asymmetric key parameters).=20

To clarify this we could add the following

"The statement SHOULD be accompanied by a short rationale, explaining
how this number was arrived at.  This explaination SHOULD include the
parameters required to achieve N bits of entropy based on current
knowledge of the algorithms."

Joe

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]]=20
> Sent: Wednesday, February 12, 2003 9:26 AM
> To: [email-masked]
> Subject: [eap] Re: Issue 79: Proposed text (Key strength estimate)
>=20
>=20
>=20
>=20
>=20
>=20
>   strength MUST be estimated. This estimate is meant for=20
> potential users
>   of the method to determine if the keys produced are strong=20
> enough for
>=20
>   The effective key strength SHOULD be stated as number of=20
> bits, defined
>=20
>   (Note: Although it is difficult to define what "comparable=20
> effort" and
>=20
>=20
>=20
>=20
> (I know that there are other papers about the same subject as=20
> Silverman's, some of which present somewhat different=20
> estimates about how strong various key lengths are, but for=20
> this purpose, a rough estimate is probably good enough)
>=20
> Best regards,
> Pasi
>=20
>=20
> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap
>=20